volume 15 issue 1, 2017 cyber security & data protection · volume 15 issue 1, 2017 cyber...

56
| MAGAZINE FOR THE IN-HOUSE COMMUNITY ALONG THE NEW SILK ROAD | asian-mena Counsel Plus ... Robin Scott of Myanmar’s City Mart Holding on working in one of the world’s frontier economies The thing about ... Managing Partner, Nagarajah Muttiah on Shook Lin & Bok’s centennial journey Visionary Providers ... We recognise legal providers that go above and beyond in the service of their clients asian-mena Counsel Cyber Security & Data Protection SPECIAL REPORT Volume 15 Issue 1, 2017

Upload: lamminh

Post on 29-May-2018

213 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

Volume 15 Issue 1, 2017

CYBER SECURITY &

DATA PRO

TECTION

ww

w.in

ho

usecom

munity.com | MAGAZINE FOR THE IN-HOUSE COMMUNITY ALONG THE NEW SILK ROAD |

asian-m

ena C

oun

sel

Plus ... Robin Scott of Myanmar’s City Mart Holding on working in one of the world’s frontier economies

The thing about ...Managing Partner, Nagarajah Muttiah on Shook Lin & Bok’s centennial journey

Visionary Providers ...We recognise legal providers that go above and beyond in the service of their clients

asian-m

ena C

oun

sel

Cyber Security & Data Protection

SPECIAL REPORT

Volume 15 Issue 1, 2017

Page 2: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

The nineteen annual gatherings of the In-House Community

along the New Silk Road

“In-House Community provides a unique combination of best

practice sharing, networking, news and technical updates that

all practitioners need in order to meet the competing

pressures of legal coverage, compliance and commerce.

In-House Community empowers the modern lawyer to work

smarter and become a trusted business partner”

Trevor Faure, Global Adviser, Legal Transformation.

Former General Counsel, Ernst & Young Global,

Tyco International, Dell & Apple EMEA.

Author of “The Smarter Legal Model: more from less”

Join your colleagues at an

In-House Congress near you

Now in its nineteenth year, the In-House Congress is region’s original and largest circuit of corporate counsel events, bringing together almost 3,000 corporate in-house counsel and compliance professionals along the New Silk Road each and every year.

For more information email us at: [email protected]

In_H

ouse

AD _

2017

.indd

FORUMS FOR THE

In-House Communitywww.inhousecommunity.com

Do you have a regular dialogue with your peer In-House Counsel

along the New Silk Road?

■ Abu Dhabi■ Bangkok■ Beijing■ Delhi■ Dubai■ Ho Chi Minh City ■ Hong Kong■ Jakarta■ Kuala Lumpur■ Manila ■ Mumbai■ Seoul ■ Shanghai■ Singapore■ Tokyo

InHouseAD_2017_AMC.indd 4 24/1/17 10:26 am

Page 3: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

Editorial Enquiries Tel: ....................... (852) 2542 4279 [email protected]

Advertising & SubscriptionsTel: ...................... (852) 2542 [email protected]

Published 10 times annually by

Pacific Business Press Limited

Room 2007, C C Wu Building, 302-8 Hennessy Road, Wan Chai,Hong Kong S.A.R.

Publishers of• ASIAN-MENA COUNSELTM

Magazine and Weekly Briefing

• IN-HOUSE HANDBOOKTM

Organisers of the• IN-HOUSE CONGRESSTM events

Hosts of• www.inhousecommunity.com• www.mycareerinlaw.com

Forums for the In-House Communityalong the New Silk Road

© 2017 Pacific Business Press Limited and contributors

Opinions expressed herein do not constitute legal advice, and do not necessarily reflect the views of the publishers.

Nick Ferguson – Managing Editor [email protected]

Brian Chun – Design Manager [email protected]

Wendy Chan – Regional Head of Events [email protected]

Gigi Ma – Events [email protected]

Rahul Prakash – Associate [email protected]

Yvette Tan – Head of Research and Development Manager

[email protected]

Yannie Cheung – Office [email protected]

Tim Gilkison – Managing Director [email protected]

Patrick Dransfield – Publishing [email protected]

Arun Mistry – Director

ISSN 2223-8697

GV Anand Bhushan is a partner and the Chennai head at Shardul Amarchand Mangaldas & Co. He has more than 15 years of extensive experience in general corporate, technology, telecommunications, corporate governance, intellectual property and litigation advisory. A Fulbright Scholar, he has substantial exposure in strategic alliances, intellectual property deal structuring, advisory and negotiation, commercial contracts, employment law and policy, advisory and policy structuring relating to corporate social responsibility and real estate.

Tarun Krishnakumar is an associate with the New Delhi office of Shardul Amarchand Mangaldas & Co. He specialises in issues relating to technology law, public policy and litigation, and advises some of the largest technology and internet players on issues includ-ing the regulation of emerging technology (such as drones and autonomous vehicles), content regulation, cloud computing rollouts, outsourcing, fintech, payments, telecoms, privacy, data protection and cybersecurity. In prior positions at the Berkman Klein Center

for Internet and Society at Harvard University and the Wikimedia Foundation in San Francisco, he has assisted on research and litigation on cutting-edge issues in privacy, intermediary liability, content regulation, and copyright.

Kenny Tung has been advising companies on strategic projects and transactions through Lex Sigma. He also co-founded In-Gear Legalytics to serve providers, clients developers and investors in the legal service value net. Previously Kenny served as the chief legal counsel of Geely Holding and before that as the general counsel in Greater China or Asia at a number of multinationals that are also household names.

Nishant Choudhary is a senior legal advisor based in the Yangon office of DFDL. In addi-tion to banking and finance, his areas of expertise include power generation, oil and gas, real estate, general corporate, telecommunications and competition law. He has worked extensively in a wide range of sectors in Myanmar on diverse transactions, including off-shore project financing, the largest onshore syndicate financing of Myanmar foreign banks branches and the licensing of one of these branches. He also has substantial experience in

the microfinance institution sector, where he has assisted with licensing and financial structuring for loan provision purposes.

Feature contributor

Empowering In-House Counsel along the New Silk Road

About the IN-HOUSE COMMUNITYA mutually supportive community of In-House Counsel helping In-House Counsel and Compliance Professionals meet their ethical, legal and business commitments and responsibilities within their organisations.

The In-House Community comprises over 21,000 individual in-house lawyers and those with a responsibility for legal and compliance issues within organisations along the New Silk Road, who we reach through the annual In-House Congress circuit of events, AsIAn-menA Counsel magazine and Weekly BrIefIng, and the In-House Community online forum.

Page 4: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

2 www.inhousecommunity.com

In this issue Volume 15 Issue 1, 2017

8

6

JURISDICTION UPDATESKey legal developments affecting the In-House Community along the New Silk Road

4 Protection against groundless threats under Indian IP laws By Rahul Beruar and Jyotsana Sinha of Clasis Law

6 Amendment to government regulation on oil and gas cost recovery

By Ahmad Jamal Assegaf of Lubis Ganie Surowidjojo

8 Maintaining a compliance programme By Justin Dominic Chi Wen and Jack Lee Yong Jie of

AZMI & Associates

10 Psychological disorders in the workplace By Diego Luis S Santiago of ACCRA Law Offices

12 Compelling foreign-based inventors to provide deposition testimony in the US

By Arthur Dong-Jin Choy of Lee International IP & Law Group

14 Labelling goods circulated in the Vietnamese market By Tran Mien Thuc of Indochine Counsel

16 The Briefing Along with the latest moves and jobs, we put the spotlight on Chinese AI

startup SenseTime’s US$410 million funding round and review our latest events in Manila and Shanghai.

4

CYBER CRIME & DATA PROTECTION REPORT22

26

Cybersecurity a boardroom priority

A proactive, top-down culture of cybersecurity is absolutely essential if your business is serious about mitigating the threat of cyber-crime, writes Rory Macfarlane of Ince & Co.

A roadmap for response and remediation to cybersecurity breaches

Treating a cyber-attack as a black swan event is uninformed and, at worst, negligent, write GV Anand Bhushan and Tarun Krishnakumar of Shardul Amarchand Mangaldas & Co.

Page 5: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

3 Volume 14 Issue 10, 2017

21

Asian-mena Counsel is grateful for the continued editorial contributions of:

30

21 Investigative Intelligence: Consolidating Indonesia’s SOEs – risk or reward? It is crucial to identify potential risks prior to establishing business ties

with an Indonesian SOE, writes Adimas Nurahmatsyah of Kroll. Due diligence and understanding possible political and reputational issues may mitigate future risks.

SPECIAL FEATURES30 How the challenges of cybersecurity reflect those in the legal

profession Cybersecurity is an organisational solution, not just a response to a

technical problem, which echoes many of the challenges facing legal professionals, writes Kenny Tung of Lex Sigma and In-Gear Legalytics.

44 Myanmar – Microfinance institutions and their obligations under the 2016 notifications: Do we now have the necessary framework?

There is a pressing need for additional guidance on the practicalities of regulatory compliance by microfinance institutions, writes Nishant Choudhary of DFDL.

33 Visionary External Providers of the Year 2017 Introducing the winners of this year’s awards to recognise legal

providers that go above and beyond in the service of their clients.

36 The Thing About… Nagarajah Muttiah As we come close to the firm’s centenary, we asked the managing

partner of Shook Lin & Bok (Malaysia) a series of questions on behalf of the In-House Community.

41 In-House Insight A former private practice lawyer who had spent his entire career in

major international financial centres, Robin Scott of City Mart Holding in Myanmar discusses his transition to an in-house role in one of the world’s most exciting frontier economies.

50 Asian-mena Counsel Direct Important contact details at your fingertips.

44

36

Page 6: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

4 www.inhousecommunity.com

INDIA

Rapidly growing awareness of intellectual property (IP) rights and a well-struc-

tured statutory regime protecting IP has allowed rights owners to assert and enjoy the limited monopolies conferred on them and prevent/restrain unauthorised third par-ties from infringing or misappropriating the exclusive rights. While IP jurisprudence is constantly evolving to protect rights owners from unauthorised encroachment of their exclusive rights in the IP, it has also led to a trend of overzealous IP enforcement, often resulting in undue liability on innocent third parties. Furthermore, such overzealous enforcement of IP rights becomes a hin-drance when groundless threats by rights owners adversely affect the businesses of innocent third parties involved in lawful and permitted use of another’s IP.

In one such instance, a well-known manufacturer of automotive spare parts was being threatened with groundless legal pro-ceedings of trademark infringement by a leading automobile manufacturer and its exclusive licencee in India. Based on the premise that the packaging of the genuine spare parts read: “Suitable for <<the make and model of the particular automobile>>”, and that such use of the make and model of the automobile (being a registered trade mark of the automobile manufacturer) quali-fied as infringement of the automobile man-ufacturer’s registered trade mark, among other things, the exclusive licencee of the said automobile manufacturer had filed sev-eral criminal complaints and lodged FIRs, spread across various cities in India, against the spare-parts manufacturer’s distributors, dealers and so on, which led to seizure of

Protection against groundless threats under Indian IP laws

By Rahul Beruar and Jyotsana Sinha

genuine spare parts produced by the spare-parts manufacturer. Interestingly, while dis-tributors and stockists of the said spare-parts manufacturer were subjected to criminal proceedings, no civil or criminal proceedings were initiated against the said spare-parts manufacturer itself.

Use of the words “Suitable for” before make and model of the automobile for which a particular spare part was suited and the prominently displayed well-known house marks of the spare-parts manufacturer clearly qualified as nominative use, permitted under Section 30(d) of Trade Marks Act, 1999. Consequently, although protected by fair/permitted use provision under the Act, the said spare-parts manufacturer was constantly subjected to groundless threats of infringe-ment proceedings.

We took recourse to one of the lesser explored remedies available under the Act, and initiated legal proceedings against such groundless threats.

Section 142 of the Act provides that a person threatened by the proprietor of a trade mark with an action/proceeding for infringement of trademark by means of issu-ing circulars, advertisements or otherwise, can bring a suit against such person making the threat and seek any or all of the following reliefs: (a) declaration to the effect that such threats are unjustifiable; (b) an injunction against continuance of the threats; (c) recover damages, if any.

However, protecting the proprietors from frivolous litigation each time they attempt to enforce their rights, Section 142 further states that if the trade mark in ques-tion is registered and the acts in respect of

which the proceedings were threatened, constitute or, if done, would constitute infringement of the trade mark, then the threat of proceedings made will be deemed justified. Moreover, if the registered proprie-tor/user conducts due diligence and initiates infringement proceedings against the said person threatened, then such threat would be deemed to have materialised and no recourse would be available with such per-son threatened except for to defend them-selves in infringement proceedings initiated by the rights holder.

Oddly, while there are specific provi-sions affording protection against ground-less threats of proceedings in the Indian IP regime, such provisions are rarely resorted to, resulting in a dearth of jurisprudence on several aspects of the framework, such as the definition of threat and “person” who can resort to the such legal remedy, among other things.

Nonetheless, to protect the rights of the said spare-parts manufacturer, we filed a civil suit under Section 142 of the Act against the automobile manufacturer and its exclu-sive licencee on the basis that the criminal complaints filed by/on behalf of the automo-bile manufacturer amount to groundless threat of trademark infringement; seeking a declaration that the use by the said spare-parts manufacturer of the make and model of the automobile on its spare parts does not amount to trademark infringement as such use falls within the exemption granted under the Act and sought injunction against continuance of such threats. While the mat-ter is still sub-judice, the automobile manu-facturer has undertaken before the court that it shall, along with its exclusive licencee, refrain from issuing any further threats until further orders are passed by the court in the said matter.

14th Floor, Gopal Das Bhawan, 28, Barakhamba Road, New Delhi 110 001IndiaTel: (91) 11 4213 0000 / Fax: (91) 11 4213 0099E : [email protected][email protected] W: www.clasislaw.com

JURISDICTION UPDATES

Page 7: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY
Page 8: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

6 www.inhousecommunity.com

INDONESIA

On June 15, 2017, Indonesian Government issued Government

Regulation No. 27 of 2017, amending Government Regulation No. 79 of 2010 on the Recoverable Operational Costs and the Income Tax Treatment in the Field Upstream of Oil and Gas Business (the new regulation is referred to as “2017 Amendment” and the original regulation is referred to as the “2010 Regulation”). The 2017 Amendment amends certain provisions on upstream oil and gas cost recovery, with a view of incentivising Contractors to accelerate discovery of oil and gas, increase investment, and provide legal certainty.

Scope of applicabilityThe 2017 Amendment remains applicable only to PSC and Service Contractors, but expands the scope of Petroleum Activities to also include field processing, transport, stor-age and sale of own-production, thus making costs associated with these activities poten-tially recoverable.

Changes to recoverable costsThe 2017 Amendment provide important changes to the conditions in order for an operational cost to be recoverable by Contractors, which are:1. removal of the elucidation to Article

12(1)(a) of the 2010 Regulation, entailing that only costs directly related to the Petroleum Operations are recoverable;

2. Community and environmental devel-opment expenditures during explora-tion and exploitation phases are now recoverable, where previously these were recoverable only during exploita-

Amendment to government regulation on oil and gas cost recovery

tion phase (see Art. 12(2)(e) 2017 Amendment); and

3. Certain costs are no longer classified as irrecoverable, the most important of which are:a. Employee income tax paid by the

Contractors, if paid as tax allowance (Art. 13(p)(1) 2017 Amendment);

b. Transactions deemed as detrimental to the state (Art. 13(l) 2017 Amendment);

c. Environmental and community development costs during explora-tion phase (Art. 12(2)(e) 2017 Amendment);

d. Incentive for interest recovery (Art. 13(w) 2017 Amendment).

4. Under Art. 13(r) 2017 Amendment, surplus materials are irrecoverable where they do not accord to the approved production plan (previously surplus materials are irrecoverable if they were purchased as a result of mistakes in planning or purchase).

IncentivesThe 2017 Amendment provides for certain tax and non-tax incentives, as follow:1. The Minister of Energy and Mineral

Resources may set a dynamic sliding scale split on the PSC. (See Art. 10A 2017 Amendment);

2. Domestic Market Obligation (DMO) Holidays, granted by the Minister of Energy and Mineral Resources after approval from the Minister of Finance; and

3. Tax and non-tax revenue incentives, in accordance with the prevailing laws and

regulations (see Art. 10(4) 2017 Amendment);

4. Exemption from the following taxes and duties:a. import duties on goods used during

Petroleum Operations, for which a Contractor is eligible at both the Exploration and Exploitation Phases (Art. 26A(1) and Art. 26B (1) 2017 Regulation);

b. Certain Value-Added Tax or or Luxury Goods Value Added Tax (Art. 26A(b) and Art. 26B(b) 2017 Amendment)

c. Income Tax on imported goods already exempt from import duties under Articles 26A(1) and 26B(1)(a) 2017 Amendment; and

d. Exemption from land and building taxes.

Please note that tax and duties exemptions during exploitation phase requires Minister of Finance approval, taking into account the economic aspects of the project.

Provisions that remain in forceCertain provisions of the 2010 Regulation remain in force, the most important of which are:1. Additional incomes in the course of

Petroleum Operation derived from the sales of derivative product or other forms are treated as deductions to oper-ational costs (See Art. 14 of 2010 Regulation); and

2. Provisions on Domestic Market Obligation (ie the obligation to deliver certain production amount for domestic market consumption) remains in force. A contractor is required to deliver 25 per-cent of production to Indonesia’s domes-tic market, for which it is remunerated at a rate set by the Minister of Energy and Mineral Resources.

Menara Imperium, 30th Fl. Jl. H.R. Rasuna Said, Kav. 1 Jakarta 12980, IndonesiaTel: (62-21) 831-5005, 831-5025 / Fax: (62-21) 831-5015, 831-5018E: [email protected] W: www.lgslaw.co.id

By Ahmad Jamal Assegaf

JURISDICTION UPDATES

Page 9: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

With our unparalleled network ofcandidates in Singapore, we arewell placed to support you on permanent and short-term hires.

“Legal Labs helped us fill a position on short notice within our tight budget and were extremely quick to the task – we couldn’t have gotten that from anywhere else!”

- AGC, Telco MNC

Room 1402, 14/F, Wanchai Central Building89 Lockhart Road, Wan Chai, Hong Kong

160 Robinson Road,#14-07 SBF Center,Singapore 068914

Singapore+65 6214 3310Licence No: 16S8074

www.legallabs.com

Email: [email protected] Kong

Page 10: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

8 www.inhousecommunity.com

MALAYSIA

A compliance programme is, simply put, a set of guidelines and procedures devel-

oped internally within an organisation to ensure that it abides by the laws and regula-tions of a country where it operates. One method to put in place a compliance pro-gramme is by having a compliance manual that consists of guidance and supporting information, together with procedures, pol-icies, controls and measures to ensure that an organisation complies with all applicable laws and regulations.

Key items of a compliance manualCorporate regulatory affairsThis category governs the system of rules and practices by which an organisation is controlled and essentially balances the inter-est of the organisation’s stakeholders. The important policies include (but are not lim-ited to):• Compliance with the company’s

constitution• Operation of the board of directors• Operation of the stakeholders’ meeting• Annual audit• Seal management• Authorisation and execution

EmploymentThis category governs the relationship between the employer and the employees, which provides guidelines for employers when dealing with employees. The impor-tant policies include (but are not limited to):• Employee benefits and compensation• Probation period management• Labour hours and leave• Occupational Safety and Health

Act 1994• Anti-harassment or protection

of special groups

Maintaining a compliance programme• Management awards and punishments• Visa compliance (for foreign employees)

Protection of personal dataThis category governs the processing of personal data in regards to commercial transactions under the Personal Data Protection Act 2010, which applies to any person who collects and processes personal data in regards to commercial transactions. A commercial transaction is defined as any transaction of a commercial nature, whether contractual or not, including any matters relating to the supply or exchange of goods or services, agency, investments, financing, banking and insurance.

Anti-corruptionThis category governs the prevention of corruption in respect of public and private sectors under the Malaysian Anti-Corruption Commission Act 2009 (MACC 2009). The offence of corruption under the MACC 2009 are as follows:• Giving or accepting gratification• Giving or accepting gratification

by agent• Corruptly procuring withdrawal of tender• Bribery of officer of public body• Bribery of foreign public officials• Offence of using office or

position for gratification

Potential PitfallsNon-compliance with any applicable law may cause an organisation to be subjected to potential fines or imprisonment. For example, pursuant to section 15 of OSHA 1994, it provides that every employer and every self-employed person has a duty to ensure the safety, health and welfare of all its

employees at work. Failure to do so is an offence liable to a fine not exceeding M$50,000 or to imprisonment for a term not exceeding two years.

Furthermore, non-compliance with any applicable laws governed under the Local Government Act 1976 may result in retrac-tion of business and advertising licences by the local authority such as Dewan Bandaraya Kuala Lumpur. Without such licences, organisations are prohibited from operating their businesses and this may cause losses to the organisation and potentially loss of repu-tation within the industry.

Benefits of a compliance manualCreating and having in place a compliance manual may be a daunting task at the begin-ning, but putting one in place is beneficial. A well-written compliance manual allows an organisation to communicate with its employees clearly on what is expected of them. It introduces the employees to the organisation’s culture, mission and values, and also educates the employees about what they can expect from the management and leadership of the organisation.

A compliance manual provides guidance to the manager or supervisor within an organisation to ensure compliance with the relevant laws and regulations to guarantee the smooth operation of the business of the organisation. This would in turn prevent an organisation from falling into any potential hazards that may cause the organisation to incur more costs.

ConclusionIn conclusion, having a compliance manual in place allows an organisation to adhere to the laws and regulations of a country by requiring its people to use best practices that can then enable the organisation to secure its business against severe risk.

By Justin Dominic Chi Wen and Jack Lee Yong Jie

T: 603 2118 5000 Ext 5017 / M: 6018 980 9093E: [email protected][email protected]

JURISDICTION UPDATES

Page 11: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

This is a small selection of our current vacancies. Please refer to our website for a more comprehensive list of openings.Please contact Lindsey Sanders, [email protected] +852 2537 7409 or Jenny Law, [email protected] +852 2537 7448

Karishma Khemaney, [email protected] +852 2537 0895 or email [email protected]

www.lewissanders.com

In-House Private Practice

M&A PARTNER/COUNSEL HONG KONG 8-15 years

Top tier international firm seeks a Counsel or junior Partner to join its M&A practice. You will have extensive APAC M&A experience, fluency in English & top tier firm training. Excellent opportunity for a Counsel to step into a partnership role. No book of business needed. AC6390

BANKING PARTNER/COUNSEL HONG KONG 10+ years

US law firm is seeking a banking partner who is an experienced finance lawyer at a reputable international law firm. You will either be a junior partner or a counsel with experience working with PRC clients. Fluent Mandarin language skills required. AC6403

ASSET FINANCE HONG KONG 5+ years

UK firm seeks a senior ship finance associate with 5+ PQE to join its team. You should have asset finance experience, ideally ship finance expertise. You should be Hong Kong admitted with experience gained from a well-regarded law firm. Chinese language skills are essential. AC6423

INSOLVENCY LITIGATION HONG KONG 5-7 years

Reputable global law firm seeks litigator with strong insolvency litigation experience from an international or HK law firm. Prior experience with business development and client-facing responsibilities will be viewed favourably. Chinese language skills preferred but not essential. AC6438

M&A/PE HONG KONG 4-6 years

Magic Circle firm’s market leading M&A/PE practice seeks mid-to-senior associate to carry out public and private M&A, PE transactions and takeovers. M&A/PE experience from a top tier international firm in Hong Kong required. Chinese language skills ideal but not required. AC3874

LITIGATION HONG KONG 5-8 years

In-house opportunity for a mid-level litigator with experience in general commercial or financial services litigation. Interesting work & good work/life balance on offer. Strong analytical skills & ability to understand complex issues are required. Fluent English & Chinese essential. AC3989

CORPORATE/COMMERCIAL HONG KONG 8-10 years

Media/telco company is looking for a senior in-house legal counsel with experience in telco, M&A, finance or commercial matters. The role will work very closely with senior management & so a strong entrepreneurial spirit is required. Chinese language skills are not essential. AC6432

MEDIA/COMMERCIAL HONG KONG 4-7 years

Global music production company seeks a commercial lawyer to advise on its music publishing activities in APAC. You will be a mid-level HK qualified lawyer with a strong commercial background. Prior IP/entertainment experience preferred. Fluent Cantonese & Mandarin needed. AC6442

FUNDS HONG KONG 5-8 years

Well-known PRC asset manager is looking for a funds lawyer to join its in-house legal team. You should have experience in a range of investment products/financial services regulatory work (both retail & private). Business level Mandarin & ability to read & write in Chinese are essential. AC6204

PROFESSIONAL SUPPORT LAWYER HONG KONG 2-5 years

MNC seeks a PSL to prepare legal templates and governance reports & assist in compliance matters. We will consider candidates with corporate, commercial or litigation background from international firms. Excellent English & Commonwealth qualification required. AC6410

BANKING HONG KONG 3-5+ years

Top tier UK firm’s finance team seeks 2 lawyers to expand team: a mid-level banking associate with strong lending experience for a mixed banking and DCM role, and a 5+ PQE banking/finance lawyer to focus on complex lending matters & acquisition finance. Mandarin essential. AC6234

REGULATORY HONG KONG 3+ years

UK law firm seeks a regulatory associate to advise on matters including setting up of regulated businesses in HK, corporate governance, AML and data privacy. Experience in regulatory advisory work and excellent drafting skills needed. Fluent Chinese language skills preferred. AC6348

CORPORATE/M&A HONG KONG 2-5 years

Well-known Chinese investment bank undergoing rapid expansion seeks junior to mid-level lawyers to join its legal team to support its growing business. Candidates with corporate finance, M&A or asset management background will be considered. Mandarin is essential. AC6429

PE FUND HONG KONG 4-7 Years

PE fund seeks a legal counsel to provide legal support on investment transactions. You will work directly with senior business management and will have a chance to gain exposure on the business end. M&A/PE experience from international firm and fluent Mandarin required. AC6452

Page 12: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

10 www.inhousecommunity.com

PHILIPPINES

The problem of mental health presents a particular conundrum under labour rela-

tions and standards. Employers and employ-ees alike walk a very thin line between recognising that psychological disorders are a real problem and therefore must be treated accordingly, and safeguarding against abuse and misreading of symptoms. It does not help that, unlike physical disabilities which can be verified easily through a mere eye test, psychological disorders by their very nature vary greatly from person to person, in terms of the originating cause, the degree, the time period or even the actual existence thereof. As a result, a valid diagnosis can be very dif-ficult, if not impossible.

Philippine statutes themselves seem reluctant to expressly categorise psychologi-cal disorders as legal disabilities, the latter enjoying special protection under law. Republic Act No. 7277, the Magna Carta for Persons With Disabilities (PWDs), defines a “disability” as a limiting impairment that is either recognised or recorded, while a “disa-bled person” is one who suffers from restric-tion or different abilities, as a result of a mental, physical or sensory impairment, to perform an activity in the manner or within the range considered normal for a human being.

While one can make the argument that a psychological disorder may be included, in actual practice this is not the case. The rea-son is because there is a complete absence of any standards that would dictate what is considered recognisable or normal for other human beings. Thus, each allegation of a disorder that would entitle a person to legal benefits is inconsistently treated on a case-by-case basis, which is also observable from the Supreme Court decisions on the matter.

Psychological disorders in the workplace

By Diego Luis S Santiago

Notably, psychological disorders are not included in the Employee’s Compensation Commission’s Table of Occupational Diseases. The only mention of anything remotely connected to mental issues is found in the case of cerebro-vascular acci-dents, wherein, there “must be a history, which should be proved, of trauma at work (to the head specially) due to unusual and

ACCRALAW Tower, 2nd Ave. Cor. 30th St., Bonifacio Global CityTaguig City, Metro Manila, PhilippinesTel: (632) 830-8000, / Fax (632) 4037007 or (632) 4037008E: [email protected] W: www.accralaw.com

ders inflict substantial burdens leading to loss of self-esteem and less effective work per-formance. Not only a person’s work situa-tion can be left debilitated by a psychological disorder, but even the quality of his or her life in general.

This dire problem is exacerbated by the fact that the Philippines has no mental health legislation at present, though there have been recent efforts. Senator Sonny Angara, in his co-sponsorship speech of the pro-posed Mental Health Act of 2017, stressed that the government should heed the stag-gering numbers that comprise the country’s mental health problem. He pointed out that surveys from the Department of Health showed that almost one out of every one hundred households had a member with a mental disorder, and that almost one-in-three employees from Metro Manila gov-ernment agencies had experienced a mental health problem or breakdown at least once in their lifetime, including specific phobias, alcohol abuse and depression. Another law-maker, Senator Grace Poe, likewise made the observation that chronic overworking, as various research suggested, could lead to threatening levels of stress.

Our dilemma therefore is no longer whether or not it is high time to legislate in favour of broadening the scope of disability definitions, but how we should do so. Whether this is through amending the defini-tion under the PWD act, or setting new classifications and policies through the enact-ment of a specific mental health bill, shedding clarity on the vagueness and place of psycho-logical disorders in disability statutes will go a long way in answering the myriad questions that have and will continue to spring up.

(Note: This article first appeared in Business World, a newspaper of general circulation in the Philippines)

“Numerous studies have

directly pointed to stressful

work conditions as a

common originating factor

for psychological disorders”

extraordinary physical or mental strain”. Neither is there any mention of mental impairments in the enumeration of total and permanent disabilities, aside from “brain injury resulting in incurable imbecility or insanity”. Psychosocial disorders are neither incurable nor considered imbecility or insan-ity, and therefore are not considered as belonging to this specification.

With the possibility of abuse always looming, it is thus unsurprising that there is cynicism and scepticism around the issue of psychological disorders. However, questions about mental health cannot be merely brushed aside due to the difficulty in pin-pointing their existence. Numerous studies have directly pointed to stressful work condi-tions as a common originating factor for psychological disorders, and that these disor-

JURISDICTION UPDATES

Page 13: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

Pure Search

Liam Richardson | In House FS Hires +852 2499 9794 | [email protected]

Michael Allen | In House FS Hires + 852 2499 9796 | [email protected]

Mike Wright | Private Practice Hires + 852 2520 5298 | [email protected]

Sherry Xu | In House C&I Hires + 852 2520 5072 | [email protected]

puresearch.com

Pure Search International Pte Ltd, Level 61, Unit 09 The Center, 99 Queen’s Rd Central, Hong Kong

LONDON | HONG KONG | SINGAPORE | NEW YORK

A global candidate network of unrivalled quality, a consistently superior service, over 30 years combined recruitment experience.

Pure Search: Your Trusted Recruitment Partner.

Page 14: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

12 www.inhousecommunity.com

SOUTH KOREA

As part of the discovery process in US patent litigation, the party accused of

patent infringement will seek the deposition testimony of the inventor (or inventors) of the patents-in-suit. A Korean company that is a party to patent litigation in the US should be aware of the circumstances under which it must ensure the participation of non-party foreign-based inventors of the patents-in-suit in a deposition held in the US forum.

As a first point, if the inventors from whom deposition testimony is sought are current employees of the defendant or plaintiff corporation, the issue is clear-cut and the US Federal Rules of Civil Procedure (FRCP) will apply. Specifically, the party to whom a deposition request is made must make available the inventor for deposition testimony under the FRCP. If the party fails to do so for a reason that is not accepted by the court, then that party will be subject to sanc-tions under FRCP Rule 37(b)(2)(A). Sanctions may include an adverse inference that the testimony would have supported the requesting party’s position and, in the worst case, a default judgment against the non-complying party.

In general, if the inventor is not a cur-rent employee of the party, or not under its “control”, then the requesting party may avail itself of The Hague Evidence Convention to obtain the sought-for evi-dence or testimony in the country in which the inventor resides.

Compelling foreign-based inventors to provide deposition testimony in the US

Poongsan Bldg. 23 Chungjeongro, Seodaemun-gu, Seoul 03737, Korea Tel: 82 2 2262 6288 / Fax: 82 2 2279 5020E: [email protected] W: www.leeinternational.com

involved for purposes of “secur[ing]” it. The court concluded that “secure” included the word “defend”, and the reference to “other proceeding” was broad enough to include litigation. The inventors were therefore obligated to appear in the US to provide deposition testimony.

Other examples of language in an assign-ment agreement that will obligate an inven-tor to give US deposition testimony is as follows: “to testify in any judicial or adminis-trative proceeding and generally to do eve-rything possible to aid [the assigned] to obtain and enforce said letters Patent in the United States when requested to do so by [assigned]”. See Aerocrine AB and Aerocrine Inc, v Apieron Inc, Civ. No. 08-787-LPS, at 108 (District of Delaware, 2010).

It must be noted that if there is no such language as referred to above in the assign-ment that may be interpreted as obligating the inventor-assignor to give testimony in an enforcement proceeding, then regardless of whether the inventor is a co-founder, a share-holder, a former president and/or a former board member of the assignee-company, under current case law in the US, the inven-tor will not be obligated to travel to the US to give deposition testimony. See Aerocrine.

Many large Korean corporations will have a well-articulated procedure for the assignment by the inventor-employee of his invention to the company. These companies should be aware that the language by which that assignment is carried out will be a point of inquiry of district courts when determining the company’s obligation to make available the relevant inventors for deposition testi-mony in the US.

By Arthur Dong-Jin Choy

However, when an inventor has assigned its patent to the company, the court will look at the terms of the assignment agreement to determine whether the inventor must give deposition testimony in the US.

For instance, in Amgen, Inc, v Ariad Pharms Inc, Civil Action No. 06-259-MPT (District of Delaware, May 14, 2007), three individuals had assigned the patent of which

they were co-inventors to the defendant, Ariad Pharmaceuticals. These inventors were not “employees, officers, directors or managing agents of the defendant”, and therefore not under the control of the defendant. The inventors, however, had signed an assignment agreement regarding the patent-in-suit that obligated them to give testimony “in any interference or other proceeding” in which the patent may be

“When an inventor has

assigned its patent to the

company, the court will look

at the terms of the

assignment agreement to

determine whether the

inventor must give

deposition testimony

in the US”

JURISDICTION UPDATES

Page 15: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

@TaylorRootLegal taylor-root

Page 16: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

14 www.inhousecommunity.com

Since its promulgation in 2006, Decree No. 89/2006/ND-CP on labelling

products is based on legal documents that, so far, have been invalidated and replaced by higher level legal documents (presently, the Law on Consumer Rights Protection, dated October 30, 2010, and the Law on Products and Goods Quality, dated November 21, 2007).

In addition to these changes, the application of Decree 89 for more than 10 years has uncovered certain limitations and inadequacies that have caused state authorities difficulty in applying it for state management tasks. It has also posed problems for enterprises in implementation of legal provisions.

In consideration of this, the government issued Decree No. 43/2017/ND-CP on Goods Labelling on April 14, 2017, which supersedes Decree 89 from the effective date of June 1, 2017.

Decree 43 does not govern, among other goods, temporarily imported goods for re-exporting or for displaying in commercial fairs/exhibitions; certain fuels and construction materials; illegally imported goods to be confiscated and then auctioned; certain fresh foods and processed foods sold to consumers without commercial packings; second-hand goods; and goods for export only.

As provided in Decree 43, product labels should be attached to the goods or commercial goods packaging at the point where people can easily find all mandatory information for a goods label without

Labelling goods circulated in the Vietnamese market

By Tran Mien Thuc

Ho Chi Minh City Office – Unit 305, 3rd Floor, CentecTower72 -74 Nguyen Thi Minh Khai, District 3, Ho Chi Minh City, VietnamTel: (84) 28 3823 9640 / Fax: (84) 28 3823 9641 / Moblie: (84) 122 412 2274E: [email protected] W: www.indochinecounsel.comHanoi Office – Unit 705, 7th Floor, CMC Tower, Duy Tan Street, Cau Giay District, Hanoi, VietnamTel: (84) 24 3795 5261 / Fax: (84) 24 3795 5262 E: [email protected]

disassembly of the parts of such goods. Goods manufacturers can determine the reasonable size of a goods label as well as the text size to make it easily read by people with normal vision. In addition, the colour of the text shall be in contrast with the label background colour and the contents of goods label shall be in Vietnamese, except for in certain prescribed cases, such as international or scientific names of drugs for human use, and the name and address of the manufacturer. In cases where a label of goods circulated domestically comprises contents in both Vietnamese and a foreign language, the contents in the foreign language shall correspond with Vietnamese ones and in the text font size which shall not be bigger than the size of the same in Vietnamese.

The mandatory information of a goods label comprises (i) name of goods; (ii) name and address of the entity responsible for the goods; (iii) the origin of the goods; and certain other information subject to the particular kind of goods as provided in Annex I of Decree 43, wherein the name of goods shall be in the biggest text font size in

comparison with other information in the label. If labels of imported goods do not comply sufficiently with such mandatory information in Vietnamese, relevant auxiliary labels shall be added, in which Vietnamese contents shall correspond with ones in the original labels, and the lacking information shall be added. Such auxiliary labels shall be attached to the goods/commercial goods packaging in a manner so that the auxiliary label does not overlap the contents of the original label. Please note that auxiliary labels are required for exported goods that are returned or cannot be exported, and in addition, a bold line of “Được sản xuất tại Việt Nam” (“Made in Vietnam”) must be presented in such auxiliary labels.

In addition to the mandatory information, a goods label may comprise other information, such as barcode and certification seals. Such information shall be true and accurate, as well as comply with regulations and laws. All goods labels shall not include signs, images, information relating to sovereignty disputes or other sensitive information.

In connection with Decree 89, Decree 43 provides transition provisions for the implementation thereof. In particular, for goods with labels that comply with Decree 89, and to be manufactured, imported or circulated on the market before the effective date of Decree 43, such goods shall be allowed to be continuously circulated until the expiry date thereof as presented on their goods labels; and for goods labels, stamps which have been printed before the effective date of Decree 43, enterprises shall have the right to continuously use such labels, stamps for a period of two years from the effective date.

VIETNAM

“The application of Decree 89 for more than 10 years

has uncovered certain limitations and inadequacies

that have caused state authorities difficulty in

applying it”

JURISDICTION UPDATES

Page 17: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY
Page 18: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

16 www.inhousecommunity.com

E V E N T R E P O R T

July proved to be an engaging month for the In-House Community in China and

the Philippines.The potential implications of China’s

new Cybersecurity Law, as well as privacy issues globally, have been front of mind for many in-house counsel in the country, so it was a well-timed Risk & Compliance Symposium at the Renaissance Shanghai Pudong on July 5, that brought together around 100 senior in-house counsel for a day of workshops and interactive learning.

The forum opened with an in-depth look at International Cybersecurity Risks from Mark Johnson and Philip Rohlik of Debevoise & Plimpton. This was followed by an introduction to China’s new Cyber-security Law, its implementation regula-tions and their impact on the compliance of international companies and internal investigations, presented by Harry Liu of King & Wood Mallesons. Following a

Cybersecurity, competition, disputes and the path to excellence addressed in Manila and Shanghai

A special thanks on behalf of the In-House Community™ to all our speakers, which included:

Ron YuGeneral CounselGilkron Limited

Philip RohlikInternational CounselDebevoise & Plimpton

Harry LiuPartnerKing & Wood Mallesons

Mark JohnsonPartnerDebevoise & Plimpton

networking lunch our assembled in-house counsel demonstrated their combined knowledge and teamwork in our unique “Game of Counterparty Risk”, adjudi-cated by our co-hosts and its co-creator, Ronald Yu.

Then on July 13, a record number of our Philippines In-House Community members gathered at the 4th Manila In-House Congress.

Opening with our themed plenary dis-cussion for the year, “The Path to Excel-lence – How to benchmark the in-house team’s evolution, and the role of external providers to assist along this path” we benefited from the combined wisdom of Joseph Trillana T Gonzales, first VP – gen-eral counsel, Aboitiz Power Corporation; Emerico O De Guzman, managing partner, Angara Abello Concepcion Regala & Cruz Law Offices; and Benjamin R Carale, part-ner at Latham & Watkins.

There followed a day of lively dis-cussion, networking and vital workshops including: “Demystifying International Arbitration”, hosted by Latham & Watkins with Jannet Cruz-Regalado, VP legal and managing counsel for global litigation Asia Pacific, Shell; “Compliance/Data Privacy and Outsourcing/Contracting Arrange-ments” from ACCRALAW; “Safeguarding Your Company Within the Information Age”, an interactive workshop by Pacific Strategies and Assessments; and “The Philippine Anti-Trust Regime in a Post Transition World”, hosted by Romulo Mabanta with valuable contributions from Commissioner Johannes Benjamin R Ber-nabe of the Philippine Competition Com-mission.

Our sincere thanks to all the speak-ers listed below for their support of these important forums for the In-House Community.

Jannet Cruz-RegaladoVice President Legal and Managing Counsel for GlobalLitigation Asia PacificShell

Chrysilla Carissa P. BautistaPartner Angara Abello Concepcion Regala & Cruz Law Offices (ACCRALAW)

Mary Rose S. TanAssociate General Counsel, Office of the General CounselSan Miguel Corporation

Joseph Trillana T. GonzalesFirst Vice President - General CounselAboitiz Power Corporation

Marc SingerDirector Business IntelligencePacific Strategies and Assessments

Carlos M. TayagPartnerRomulo Mabanta Buenaventura Sayoc & de los Angeles

Emerico O. De GuzmanManaging PartnerAngara Abello Concepcion Regala & Cruz Law Offices (ACCRALAW)

Sophie J. LambPartnerLatham & Watkins

Louie T. OgsimerPartnerRomulo Mabanta Buenaventura Sayoc & de los Angeles

Franchesca Abigail C. GesmundoAssociate Angara Abello Concepcion Regala & Cruz Law Offices (ACCRALAW)

Benjamin R. CaralePartnerLatham & Watkins

Jason CruisePartnerLatham & Watkins

Mark CondonDirectorPacific Strategies & Assessments

Johannes Benjamin R. BernabeCommissionerPhilippine Competition Commission

“You are doing a great service to the profession. Please keep it up!”

– In-House Congress Manila delegate

The Briefing

Page 19: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

In-houseGroup Investigation Counsel | 10+ yrs pqe| Tokyo REF: 13853/AC This multinational corporation is seeking a qualified lawyer with proven investigation experience to head the global investigations function. Ideally based in Tokyo, this lead role will be responsible for overseeing all investigative activities and developing investigation capabilities globally with a focus on Asia and the emerging markets. The successful candidate will have at least 10 years’ PQE in FCPA and compliance investigations gained in a multinational law firm or company and preferably experience in both Common Law and Civil Law jurisdictions. Candidates with the ability to manage complex investigations and litigation are best suited for the role. Native-level English is essential and proficient Japanese is an advantage.

Senior Legal Counsel | 8-10 yrs pqe | Beijing REF: 14022/AC This Fortune 500 media and entertainment company is seeking a Senior Legal Counsel with business acumen to join its dynamic legal team based in Beijing covering China operations. You will report to the Head of Legal and be responsible for providing legal advice to management team within China on all legal matters with a focus on network distribution, production issues and business development activities. With 8-10 years’ PQE and a PRC legal qualification, you will have solid experience in contractual, commercial and IP work at a leading law firm or a media/consumer/digital company. Compliance and regulatory experience is highly desirable. You must have excellent drafting skills, be pro-active and have initiative. Fluent English and Mandarin required.

VP, Equities | 6-10 yrs pqe | Hong Kong REF: 14015AC This global investment bank is seeking a prime finance/equities lawyer to join a busy team based in Hong Kong to cover Asia Pacific. This role will mainly cover equities, prime brokerage and prime finance work. You must have the

Private PracticeAssociates | 4-8 yrs pqe | Hong Kong REF: 139985/AC One of the largest legal networks in the world is seeking multiple associates to join their expanding function in Hong Kong. You will be responsible for providing advice on a range of corporate and commercial matters as part of a varied and interesting workload. Ideally, you are Hong Kong qualified with 4-8 years’ PQE in pre/post IPO and M&A work at international or leading local law firms. This role offers excellent career prospects and top compensation. Fluency in Chinese is preferred but not essential.

Associates | 4-6 yrs pqe | Hong Kong REF: 14016/ACDynamic corporate lawyers are required at this growing international law firm in Hong Kong. Ideally, you are Common Law qualified with 4-6 years’ PQE in PE fund formation and/or M&A work at top law firms. Candidates must be highly motivated, have a commercial mind-set and be confident of working independently as well as having fluent English and Chinese skills.

Stand Out With Hughes-Castell

To find out more about these roles & apply, please contact us at: T: (852) 2520-1168E: [email protected] www.hughes-castell.com

relevant technical skills dealing with equity derivatives and have between 6-10 years’ PQE gained at preferably both a top international law firm and a global investment bank. Chinese language skills are desirable but not essential. Candidates from overseas with relevant experience are welcome to apply.

Legal Compliance Officer | 5+ yrs pqe | Jakarta REF: 14017/AC Exciting newly-created role as legal and compliance counsel for Indonesia for this top Fortune 500 US multinational technology company. Based in Jakarta you will be responsible for leading and managing all legal matters and compliance programs in Indonesia. The range of issues includes contract reviews, corporate governance, compliance and investigations, management of litigation and staff trainings. You must be Indonesian qualified with at least 5 years’ PQE in a multinational corporation environment. In-house experience of ethics and compliance work is essential as is fluency in English and Bahasa Indonesia. Occasional travel outstation to conduct trainings.

Front Office Lawyer | 4+ yrs pqe | Hong Kong REF: 13996/AC This world-renowned investment bank is seeking a highly motivated lawyer to join its debt trading group. This is a unique opportunity to transition to a front office role outside of legal and support deals on the trading floor. Directly reporting to the Hong Kong MD, you will draft and negotiate NDAs, LMA trade documentation and structure and manage special situations/private financing and portfolio transactions. Ideally, you have at least 4 years’ experience in any of the following areas: debt capital markets, insolvency, credits and lending work at an international law firm and/or financial institution. Those who are eager to learn, fast thinking and resilient, and can work in an extremely fast-paced environment are sought. The ability to read Chinese is required.

Senior Trademark Agent | 3-5 yrs exp | China REF: 14020/ACThis growing intellectual property boutique firm is seeking a mid to senior trademark agent to join its Shanghai or Beijing office. You will mainly be responsible for handling trademark application, opposition and related litigation independently. You will work on copyrights, domain name and general IP work upon request. Ideally, you have a LLM with at least 3-5 years’ trademark examination/trademark agent experience. You must have fluent English and Mandarin language skills for the role.

Associates, Compliance & Investigations | 2+ yrs pqe | Shanghai REF: 13989/ACTop European law firm seeks a Compliance Lawyer to join its world-leading compliance and investigations team in Shanghai. You will mainly advise its European clients on compliance matters in China and provide assistance in investigations across Asia. Ideally, you are qualified lawyer with 2-4 years’ relevant PQE at a top international or Chinese law firm in China. Knowledge of PRC law and up-to-date regulatory requirements and internal investigation experience are essential. Must have good drafting skills plus fluent written and oral English.

Your privacy and the privacy of others are important. By you supplying us with your personal data, which includes your CV and/or details of your referees, you have agreed to our collection, use and disclosure of such data to assist you in finding a job now or in future, as well as for marketing purposes. You agree that you have obtained appropriate consent to provide to us data from other person(s).

AC May_17 Stand.indd 1 5/8/2017 10:33:44 AM

Page 20: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

18 www.inhousecommunity.com

AUSTRALIA

Norton Rose Fulbright has further boosted its national corpo-rate team with the addition of international corporate and M&A lawyer Martin Irwin as a partner in the Sydney office. Joining from Baker & McKenzie, Irwin focuses on infrastructure, energy and resources, privatisation and project finance. He advises insti-tutional and strategic investors and other capital providers on M&A, public private partnerships, project finance and corporate finance transactions. His clients include some of the world’s big-gest pension funds, global and Australian banks, and multinational companies.

CHINA

Clyde & Co has added Elliot Papageor-giou as a partner in its Shanghai office. Papageorgiou is joined by a team of four China-qualified and licensed lawyers. He joins from Rouse, where he has built an intellectual property practice in the Asia Pacific, especially China, for the past 12 years. He focuses on the full IP-lifecycle, from strategic IP protection and portfolio advice, to IP exploitation and commercialisation, IP enforcement and litigation.

DLA Piper has added James Chang as a corporate partner in Beijing. Chang focuses on public and private cross-border M&A, leveraged buyouts, private equity transactions, and general cor-porate governance and securities law matters. He is experienced in advising corporations, private equity funds, boards and man-agement in M&A transactions, as well as related debt and equity financings. He also has wealth of experience advising investors and companies on pre-IPO investments, as well as advising investment funds and corporations on US securities regulations and corporate governance matters.

Hogan Lovells has added Larry Sussman in its corporate practice as a partner in Beijing, China. Sussman is a tax lawyer with broad corporate transactional capabilities. He joins from O’Melveny & Myers. Sussman focuses on representing multina-tionals, private equity, and financial services companies on a broad range of matters.

DUBAI

Clyde & Co has appointed Matthew Heywood as a partner in its global projects and construction practice. Based in the firm’s Dubai office, he will be the sixth specialist construction partner in the firm’s Middle East construction practice. He previously led the construction disputes and Middle East group at Osborne Clark in London, and previously spent five years in Dubai with the construction group of another international law firm. Heywood is

a leading disputes lawyer with more than 15 years of experience. He specialises in contentious construction, particularly complex cases with multiple parties. He advises clients across the Middle East on the resolution of disputes arising out of major infrastruc-ture projects.

HONG KONG

Simmons & Simmons has added Michael Chin as partner, expanding the firm’s corporate and commercial practice in Hong Kong. He joins from Hogan Lovells and brings over two decades of extensive experience advising on a broad spectrum of corpo-rate transactions across the Asia Pacific. Chin has represented both multi-national and Chinese clients on a range of public and private M&A transactions, as well as supporting fundraising and investments by both private equity and venture capital funds. He has advised clients across a variety of sectors, including TMT, life sciences, automotive and clean energy. His appointment is subject to standard regulatory approvals.

INDIA

Luthra & Luthra has added Akhil Anand as a litigation partner. With over 13 years of extensive experience, he handled mat-ters relating to the Information Technology Act, Companies Act, Arbitration Act and criminal laws. Prior to this move, he was a partner at Shardul Amarchand Mangaldas and previously headed the litigation prac-tice at Poovayya & Co’s Delhi office. Anand started his career as an associate in Luthra & Luthra.

Shardul Amarchand Mangaldas has added Veena Sivaram-akrishnan as a partner in the Mumbai office, with effect from August 25, 2017. She has over 13 years of experience in advising clients in the banking, restructuring and financial services domains. After her graduation from the National Academy of Legal Studies & Research University in Hyderabad, she worked with Juris Corp, and also spent some time at Davis Polk & Wardwell. She worked with ICICI Bank as an in-house counsel before returning to Juris Corp as a partner.

SINGAPORE

Bird & Bird, through its global association with Bird & Bird ATMD, has added Kim Kit Ow, one of Singapore’s leading finan-cial specialists, as a partner in the Singapore office. Ow joins from RHTLaw Taylor Wessing, where she was deputy head of its bank-ing and finance practice. Ow specialises in financial services, cor-porate and banking transactions. She advises on the legal aspects of product development, transactions and documentation, both from an investment and private banking angle.

The latest senior legal appointments around Asia and the Middle East

M O V E S

Elliot

Papageorgiou

Akhil Anand

The Briefing

Page 21: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

19 Volume 15 Issue 1, 2017

asian-mena Counsel Deal of the Month

China’s leading artificial intelligence startup SenseTime Group raised

US$410 million in July in the largest single-round investment in an AI com-pany globally.

Founded by a group of scientists from the multimedia laboratory of the Chinese University of Hong Kong, SenseTime offers advanced AI-based applications, including facial recognition and smart surveillance, to clients such as Huawei and China Mobile.

The transaction is a reflection of China’s booming AI industry and, more broadly, its efforts to move towards a more innovation-driven economy. For its part, SenseTime is being championed as a Chinese AI pioneer.

“China was able to create world-class companies like Alibaba and Ten-

D E A L O F T H E M O N T H

cent during the internet age,” said Wu Shangzhi, chairman of CDH Investments, to Chinese media. “We hope to see Chi-nese AI giants in the age of artificial intel-ligence. CDH will support China’s largest AI company SenseTime to give birth to a world-leading AI conglomerate.”

The increasing capability of AI soft-ware garnered significant attention in Asia earlier this year when Google’s

Chinese AI startup SenseTime raisesUS$410m

Other recent deals:WongPartnership acted for Expedia on its US$350 million minority invest-ment in Traveloka Holding, a leading South East Asian online travel company. Trav-eloka raised about US$500 million from two funding rounds within the last year, in which Hillhouse Capital Group and Sequoia Capital were among the four other companies which contributed the remaining US$150 million in a separate round. Partners Chou Sean Yu, Vivien Yui, Ong Sin Wei, Jeffrey Lim and Lim Wei Lee led the transaction.

DLA Piper is advising China Eastern Airlines on a global joint venture between Air France KLM, Delta Airlines and China Eastern Airlines, which have been con-solidated by investments by China Eastern and Delta in Air France KLM. Delta and China Eastern will each acquire a 10 percent stake in Air France-KLM’s share

capital within the framework of reserved capital increases totalling €750 million (US$887m). Air France-KLM and China Eastern will step up their commercial cooperation and reinforce their partner-ship within the framework of the existing JV. The transaction will seal a long-term partnership to secure Air France-KLM’s access to the Chinese market and give it a European leadership position in Shang-hai, the main business market in China. Shanghai country managing partner Qiang Li, corporate partners Stewart Wang (Shanghai) and Paris location head Jeremy Scemama, and litigation and regulatory partners Casper Hamersma (Nether-lands), Alexandra Kamerling (London) and Asia head of investigations and anti-trust and competition Nate Bush (Singa-pore) led the transaction.

Herbert Smith Freehills advised global TMT investor Softbank on its investment

in a new equity funding round for South-east Asia’s Grab, an online transporta-tion and payments platform. Softbank will lead the investment in the current fund-ing round, alongside China’s Didi Chux-ing, the world’s leading one-stop mobile transportation platform, to together invest up to US$2 billion. With an additional US$500 million anticipated before close, this would be the largest single tech financ-ing in Southeast Asia. Asia head of TMT Mark Robinson, assisted by Asia head of competition Mark Jephcott and partners Graeme Preston (Tokyo-corporate) and Kyriakos Fountoukakos, led the trans-action, working closely with Prolegis, its formal law alliance Singapore firm, and partner Sakurayuki from Hiswara Bunja-min & Tandjung, its associate Indonesian firm in Jakarta. Didi Chuxing was advised by Paul, Weiss, led by corporate partners Judie Ng Shortell, Jack Lange and Betty Yap.

AlphaGo beat the world’s top-ranked Go player in a man-versus-machine series.

SenseTime’s Series B preferred share investment attracted participation from renowned private equity funds and insti-tutional investors, including CDH, Sailing Capital and China International Capital.

“The US$410 million series B round will be used to deepen our research of technology innovation, to expand our product lines and explore new applica-tions in verticals such as autonomous driving,” SenseTime founder and chief executive Xu Li said in an announcement. “We will also strengthen cooperation with both upstream and downstream partners to explore more applications [for our technology].”

Clifford Chance partner Fang Liu led the transaction.

The transaction is a reflection of China’s

booming AI industry and, more broadly, its efforts to

move towards a more innovation-driven economy

Page 22: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

20 www.inhousecommunity.com

Senior Counsel APAC, Food and Beverages10+ yrs PQE, Singapore

A multinational food and beverage company is seeking a common law-qualified

lawyer with solid commercial/corporate experience to be based in Singapore

to support its business in North Asia. You will provide legal and compliance

support on M&A, contracts, daily operations and a wide range of corporate and

commercial issues plus managing outside counsel. You ideally have an LLM degree

with at least 10 years’ PQE in commercial, corporate and transactional work,

ideally gained in a top law firm and/or an MNC. Fluency in English is required

with a professional command of Mandarin a strong plus. [Ref: 14112/AC]

Contact: Branda Lai

Tel: (65) 6220 2722

Email: [email protected]

Legal Counsel, Marine/Infrastructure3+ yrs PQE, Singapore

A renowned marine and infrastructure group is looking for a junior/mid-level

lawyer to join its legal team. You should have at least three years’ corporate

experience in a law firm and/or as in-house counsel (ideally with a Singapore

listed company). Familiarity with listco matters would be a distinct advantage.

The ideal candidate should be commercially astute, with excellent negotiation

and communication skills. [Ref: A43370]

Contact: Michelle Poh

Tel: (65) 6214 3310

Email: [email protected]

Legal Counsel, Manufacturing6-8 years PQE, Singapore

A leader in the manufacturing field with strong operations in Asia is looking for a

lawyer to assist primarily with Southeast Asia markets (with a focus on Malaysia)

in the areas of sales, marketing and distribution. Drafting and negotiating

contracts with customers, distributors and suppliers will be the mainstay of the

role, however, you will also be required to assist with areas such as IP, M&A and

compliance. Ideally you have strong commercial experience gained in Malaysia,

and the ability to speak Malay fluently. [Ref: JGB — IS 1732]

Contact: Benedict Joseph

Tel: (65) 6818 9707

Email: [email protected]

Head of Legal, Insurance10+ yrs PQE, Hong Kong

A well-known insurance company seeks a head of legal to support its Hong Kong

business. As well as managing the legal department the head of legal is expected

to play a hands-on role advising on product launches as well as developing

and maintaining good relations with the various regulatory bodies. Fluency in

Cantonese is critical. [Ref: IHC 15549]

Contact: Claire Park

Tel: (852) 2920 9134

Email: [email protected]

Head of Legal (APAC), MNC15-20 yrs PQE, Singapore

A global MNC and a leading player in the sector it operates in

is currently seeking a high calibre lawyer to head up its regional

(APAC) legal team. Reporting to the regional CEO and functionally

to the global GC, you will lead a team to manage all legal and

compliance matters in the APAC markets. Entities under your

care includes procurement, R&D, manufacturing, distribution as

well as retail (direct). As part of the APAC leadership team, you

will also be participating in the strategy initiatives of this region

that you cover. Ideal candidate will be a Commonwealth-qualified

lawyer with some 15-20 year’s PQE acquired in a reputable law

firm and MNC with superb stakeholder management skills. [Ref: R/

MK04268]

Contact: Michelle Koh

Tel: (65) 6407 1202

Email: [email protected]

Head of Legal, Consumer Products8-12 yrs PQE, Hong Kong

An MNC in the consumer products industry is looking for a

head of legal in Hong Kong. You will be responsible for providing

legal support to the company’s businesses in the Greater China

region. You will also be in charge of developing legal strategy and

structure. The ideal candidate will have experience in drafting and

reviewing commercial contracts, handling anti-trust/competition,

litigation, and general corporate and regulatory issues. Ability to

work independently and deal with senior management is essential.

Experience in handling PRC legal matters as well as fluent English,

Cantonese and Mandarin are required. [Ref: PBP6619]

Contact: Eleanor Cheung

Tel: (852) 2537 7416

Email: [email protected]

PRC Legal Counsel, Telecoms5+ yrs PQE, Hong Kong

A global telecommunication corporation now seeks a PRC lawyer

to join its APAC regional legal team in Hong Kong. This role

will be based in Hong Kong supporting the China operations.

This is a broad general commercial focused role where you will

be supporting on a wide range of commercial contacts, sales,

marketing, general corporate and general compliance matters.

Candidates with PRC corporate/ capital markets experience

from international law firm backgrounds (without relevant telco

experience) would be considered. In-depth knowledge of China

laws and fluent Mandarin skills a must. [Ref: 11076]

Contact: Charmaine Chan

Tel: (852) 2951 2104

Email: [email protected]

Opportunities of the Month …

Be it a case of wanting to spice things up or break the pattern, every now and then, it's nice to know there's something else. Whether you do so casually or stringently, take a look below to see what the legal sector can offer you.

Page 23: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

Investigative Intelligence

21 Volume 15 Issue 1, 2017

Consolidating Indonesia’s SOEs — risk or reward?

[email protected]

State-owned enterprises (SOEs) are key business players in Indonesia’s economy with their dominance in

strategic industries. Indonesia’s constitution mandates the government to control “livelihood of Indonesians” industries, thus making the government the market leader in certain sectors. Four of the six largest Indonesian banks: Mandiri, BRI, BNI and BTN are state-owned. In the upstream oil and gas sector, state-owned Pertamina boasts the second-largest production capacity in Indonesia, behind Chevron Indonesia, but Pertamina will soon take over Chevron’s sites in Sumatra and Kalimantan Islands.

The Jokowi administration is creating several holding companies to consolidate numerous SOEs. Approximately 34 SOEs are projected to be government-owned through several holding companies; Pertamina (oil & gas), Danareksa (banking and financial services), Hutama Karya (toll roads & construction), Inalum (mining), PT PP, (housing) and Bulog (food and agriculture). Additionally, the consolidation of healthcare SOEs is under the Indonesian Healthcare Company.

This consolidation programme is for Indonesia to remain competitive with its Asean neighbours. Four major state-owned banks will make Danareksa one of the five largest financial services companies in Southeast Asia, with total assets of US$200 billion. With the exception of the high-profile acquisition of Thang Long Cement in Vietnam in 2012 by Semen Indonesia, an Indonesian state-owned cement

holding company, knowledge of investments is scarce. Globally, Indonesian SOEs are behind their Southeast Asian counterparts in terms of recognition and prominence as investors.

Government regulations in Indonesia have made it difficult for Indonesia’s SOEs to expand further into the global stage. The government’s recent issuance of Government Regulation No. 72/2016 in December 2016, which allows the transfer of SOE’s capital into subsidiaries without consulting with the parliament is seen by many as a step in the direction to facilitate this expansion. This provides SOEs with more autonomy to deploy capital strategically.

Global expansion is vital if Indonesia’s SOEs’ are to generate new sources of profit outside their traditional markets. Indonesia’s largest banks, for example, are unknown outside of their home market in stark contrast to banks from Malaysia, Singapore and Thailand. Observers claim that the banking markets in these countries are not as exciting as Indonesia’s rapidly emerging market, making investments in neighbouring markets less promising for Indonesian banks in terms of profitability. However, profit and growth are not the only considerations for expanding globally. National pride, international political leverage and diversifying risks could justify foreign expansion.

To prominent Indonesian businessman John Riady, quoted in The Guardian newspaper last November, Indonesia is the biggest invisible thing on earth. Despite the country’s huge

potential, many Indonesian businesses are domestically focused. For global recognition, the regulation changes in 2016 could pave the way for foreign investors to partner with Indonesia’s SOEs, both domestically and internationally. In Indonesia, partnerships like this will leverage the SOE’s dominance of local markets.

Despite the promising opportunities, SOEs are under constant scrutiny by law enforcement and anti-corruption agencies in Indonesia. During the Yudhoyono administration, two of the largest state-owned construction companies, WIKA and Adhi Karya, were implicated in corruption scandals. The scandal incriminated high-profile politicians, the then Minister of Youth and Sport and the former chairman of the Democratic Party.

In the oil and gas sector, Pertamina was reported to be colluding with an oil and gas cartel, causing state losses of up to US$18.5 billion in 2012-2014 according to an independent auditor. This finding has been reported to the country’s Corruption Eradication Commission and remains under investigation.

It is therefore crucial to identify potential risks prior to establishing business ties with an Indonesian SOE. Due diligence and understanding possible political and reputational issues might mitigate future risks.

By Adimas NurahmatsyahSenior Associate

Page 24: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

CYBER CRIME & DATA PROTECTION REPORT

22 www.inhousecommunity.com

By Rory Macfarlane, Partner, Ince & Co Hong Kong

Cybersecurity a boardroom priority,says Ince & Co

Had Benjamin Franklin been alive today he would have probably added ‘cyber-attack’ to his list of life’s certainties. It is no longer a question

of ‘if’ your business will face a cyber-attack; but a question of ‘when’. With 60 percent of companies that suffer a successful cyber-breach going out of business within six months1 this issue is no longer one that a prudent board can ignore.

Cyber-attack now sits at the top of most tables depicting business risk2. As with any form of crime, the perpetrators are looking for the easy victim; the low hanging fruit. Ensuring that your business is better protected than your competitors is a significant step in the right direction.

Recent attacksIt seems likely that when we reflect on 2017 in years to come it will be viewed as the year in which cyber-attacks, and the complementary issue of cybersecurity, reached the wider public consciousness for the first time. This is particularly true in the shipping, transport and logistics industries where the impact has been acute. But the lessons to be learned, and the warnings such incidents give, apply to all businesses across every market or sector.

Consider the recent ‘not-Petya’ cryptoware or ‘data wiper’ attack. It drew headlines around the world, notably within the global transportation sector, for temporarily shutting down parts of the leading Danish shipping company Maersk Line. That the attack did not impact Maersk’s ability to physically load and transport containers, but instead targeted data-driven processes such as obtaining customs and port clearance, did not prevent it causing considerable operational difficulties for Maersk. This in turn led to significant

disruption at key ports around the world.That high-profile attack, coming so soon

after the ‘WannaCry’ ransomware incident earlier this year, provided yet another reminder of just how damaging cyberattacks can be. No organisation or business sector is immune. One-third of the UK’s National Health Service was affected by Wannacry, and the victims of not-Petya ranged from the radiation monitoring system at Chernobyl, to a European pharmaceutical company and a global advertising agency.

The attack threat — popular perception vs reality.Every company will have its own vision of what a catastrophic cyberattack could look like for it. However, the popular imagination tends to lean towards Hollywood-inspired images, perhaps of an oil rig or a ship being remotely ‘taken over’ by nefarious forces, to devastating effect. However, the reality for most organisations is very different.

That is not to say that a vessel, a vehicle, an industrial facility or any equipment that has internet connectivity and digital operating systems couldn’t be ‘hijacked’ remotely; they have been. Future cyber-attacks certainly do have the potential to be deleterious to the physical assets of an organisation, to the safety of the people working on, or in, them and to the wider environment. Each sector must address the unique challenges that its’ physical infrastructure poses. For the shipping industry, there is rightly a lot of attention right now on the vulnerabilities that arise from increasing levels of on-board digitalisation, automation and ship to shore connectivity.

But neither the shipping industry, nor any other business sector, should be lulled into the complacency of believing that it is only

“Nothing is certain but death, taxes and cyber-attack”

Page 25: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

Cybersecurity a boardroom priority, says Ince & Co

23 Volume 15 Issue 1, 2017

physical assets that are attractive to cyber-criminals or cyber-terrorists. Your data, and your money are the primary targets. Most cyber-attacks will focus on the operations that are not outwardly visible, but that can be no less damaging, commercially, financially and reputationally. These attacks can take many different forms and are more likely to be indiscriminate than targeted.

Cost of a successful breachIn an increasingly digitised world, cyber-breaches can have far-reaching consequences and costs. Individual losses from a single event can be huge. Last year’s now infamous hack of the Bank of Bangladesh systems resulted in a US$81 million loss from a single event3. One estimate suggests that the annual global cost of cybercrime is forecast to rise to US$2.1 trillion by 20194.

Despite these of risks, many companies still remain unaware and unprepared for the consequences of a cyber-breach of their operations. Both not-Petya and WannaCry provide examples of how damaging and costly an attack can be. Indeed, Maersk has recently said that it is “too early” to fully ascertain what their losses might be from the not-Petya attack5. Second- and third-quarter financials will reveal the true cost of what was — at its origination — a relatively small cybersecurity breach.

According to a Bloomberg report, the attackers behind the Wannacry ransomware and the not-Petya data wipe earned just US$160,000 in bitcoin6. However, to quantify the impact of ransomware and phishing attacks solely in terms of ransoms paid or monies mis-appropriated is a mistake. The losses in terms of business interruption, rectification and market reputation can run to many millions of

dollars. When the additional costs from lost sales and remedial action are factored in, it is estimated that the Wannacry and not-Petya cyber-attacks will have resulted in hundreds of millions of dollars of revenue foregone by the affected businesses7.

The impact on individual affected companies is similarly staggered. A large European skincare product manufacturer claims to have lost over US$41 million in sales in the first half of 2017, which does not include the cost of held inventory and halted production in its 17 plants. The company’s HQ in Hamburg, as well as computers from over 160 offices around the world, were infected. Similarly, 2,000 servers and 15,000 laptops were attacked at a UK-based consumer goods company, resulting in lost sales of US$118 million, with manufacturing capacity severely affected.

Has the boardroom been too slow to react?The best form of defence is a proactive approach to minimising cyber-risk. It is increasingly becoming clear that security protocols and a cyber-response plan are not optional ‘nice to have’ extras, but something that should be considered and addressed at the very highest level within every organisation. That in many cases this is still not happening is confounding.

“Most cyber-attacks will focus on the operations that are not outwardly visible, but that can be no less damaging, commercially, financially and reputationally”

Page 26: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

CYBER CRIME & DATA PROTECTION REPORT

24 www.inhousecommunity.com

One reason might be traced back to the unfounded hype surrounding the last big IT scare, namely the Millennium Bug or Y2K panic. This was the feared computer bug relating to the formatting and storage of calendar data. It arose because 20th century computer software only recoded dates in four digits, with the last two representing the year. The fear was that on the turn of the millennium computers would not be able to differentiate between the year 2000 and 1900. The media was awash with predictions of planes falling from the skies, life savings disappearing and millions being wiped off the stock markets. None of this ever happened. It was the bug that did not bite. The tens of thousands of dollars that companies spent on contingency plans and safety nets was wasted. However, its legacy may be that many executives view cyber-crime risk in a similar light and are accordingly hesitant to invest in protection. That would be a mistake. While the Millennium Bug may have been a fiction, cyber-crime is not. Directors who ignore the need for appropriate cybersecurity systems are not just exposing their businesses to risk, but could themselves face personal sanction for breach of the fiduciary duty they owe to their companies.

Protecting your businessFor those working within cybersecurity, these recent high-profile attacks came as little surprise. But might they be the tip of the iceberg? There have been over 70 different ransomware attacks in the four months since Wannacry although these have been largely ignored by the mainstream media. Some estimates already place the global number of victims of cyber-crime as high as 300 million

“When the additional costs from lost sales and remedial action are factored in, it is estimated that the Wannacry and not-Petya cyber-attacks will have resulted in hundreds of millions of dollars of revenue foregone by the affected businesses”

per year8 but the reputational damage for companies could have an even bigger, hidden cost. A pristine track record for service, reliability and regulatory compliance could be irreparably damaged in the event of a severe, public breach.

While the costs of this type of damage are hard to quantify, they add yet another reason to an already lengthy list of good reasons to invest in appropriate cybersecurity systems and employee protocols. The importance of this latter step, employee protocols, cannot be emphasised enough. To some it may seem counter-intuitive to focus on staff when implementing defences to cyber-attack; but it isn’t. In more than half of the successful cyber-attacks the source of the breach can be traced back to an ‘insider’ — someone who works for the company. Sometimes it is a disgruntled ex-employee with an axe to grind. But more often it is the innocent, unintentional act of a loyal employee unfamiliar with the technological or social-engineering tricks employed by cyber-criminals.

With regulators generally currently encouraging self-initiative on the part of companies rather than imposing punitive fines for non-compliance, the onus is on each business to develop its own contingency plans. What constitutes an appropriate plan will vary from business to business, depending on how it uses and stores its data. Every organisation also needs to be alert to the regulations governing data protection and cybersecurity in their jurisdiction.

Improving your cyber protection need not be costly. Significant improvements can be made for a modest investment. Moreover, in some jurisdictions, for example Hong Kong9, funding is available to assist companies in meeting the cost of improving their protection.

Steps should be taken to ascertain if existing insurance coverage extends to cyber breach losses. Although insurance provides a financial safety-net, it is no substitute for good cybersecurity practice. Whilst the added assurance of assistance in the event of a breach is a comforting element of any contingency plan, responding to a cyber breach can be costly. Most organisations do not have the funds immediately available to mount an effective response to a cyber-breach, even if

Page 27: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

Cybersecurity a boardroom priority, says Ince & Co

25 Volume 15 Issue 1, 2017

[email protected]

http://www.incelaw.com/en

Tel: 852 25877 3221Fax: 852 2877 2633

“It is increasingly becoming clear that security protocols and a cyber-response plan are not optional ‘nice to have’ extras, but something that should be considered and addressed at the very highest level within every organisation”

they do have an appropriate response plan in place. There are insurance products available in the market which provide access to funds for this very purpose.

Ince & Co is working with the leading cybersecurity team at Navigant to help companies address their businesses cybersecurity needs through a cyber health-check. This product can be tailored to meet specific needs. It usually covers a technical review of the IT systems, an evaluation of relevant protocols, contracts and policies, a summary of applicable regulatory obligations and an analysis of insurance cover. The health-check is intended primarily to be used to minimise the chances of a breach occurring. However, it also has a role to play as part of the response to a successful attack in order to plug holes, revise protocols, ensure a system is not still compromised and provide a list of ‘lessons learned’ to the board for future strategic planning. With it now being commonplace for cyber-criminals to remain in a system for up to six months after an initial breach before striking, it may be that your business is already more at risk than you realise.

ConclusionPrevention is always better than cure. A pro-active, top-down culture of cybersecurity is absolutely essential if your business is serious about mitigating the threat of cyber-crime. But the lead must come from the board; it cannot be left to the IT team. To be effective it is something that must be imbedded into the culture of a business. Whilst applying software patches is crucial, it is not enough on its own. As global businesses across every sector of our economy embrace the benefits of the cyber-age and digitalisation in all its forms, it is only prudent to ensure that we also manage the risks.

End Notes:1. https://www.inc.com/thomas-koulopoulos/the-

biggest-risk-to-your-business-cant-be-eliminated-heres-how-you-can-survive-i.html

2. http://www.securitymagazine.com/articles/87856-cyber-tops-list-of-threats-to-business-continuity

3. http://www.reuters.com/article/us-cyber-heist-philippines-idUSKCN0YA0CH

4. https://www.forbes.com/sites/stevemorgan/2016/01/17/cyber-crime-costs-projected-to-reach-2-trillion-by-2019/#482f23253a91

5. https://uk.reuters.com/article/us-cyber-attack-maersk-idUKKBN19S0FX

6. https://www.theguardian.com/technology/2017/aug/03/ransomware-future-wannacry-hackers

7. http://www.ibtimes.co.uk/wannacry-petya-companies-hit-by-attacks-have-lost-hundreds-millions-costs-1633561

8. http://www.incelaw.com/tw/knowledge-bank/cyberattacks-make-companies-and-governments-wannacry

9 http://www.itf.gov.hk/l-eng/TVP.asp

Page 28: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

CYBER CRIME & DATA PROTECTION REPORT

26 www.inhousecommunity.com

By GV Anand Bhushan and Tarun Krishnakumar, Shardul Amarchand Mangaldas & Co

Cybersecurity Incidents: A roadmap for response and remediation

Cyber(in)security: The new status quoCybersecurity professionals are no doubt familiar with the oft-repeated adage that there are only two kinds of companies — ‘those that have been breached’ and ‘those who do not know it yet’.

While in many settings a third category of entities — affected by breaches which remain undisclosed — exists, the increasing potency of attacks and the public spill-over of their effects mean that this category is rapidly collapsing into the former. In this respect, the year 2016 heralded a paradigm shift in the way cybersecurity concerns were perceived by the Indian private sector. What were previously assumed to be largely hypothetical and remote concerns assumed manifest proportions with sophisticated attacks causing widespread disruption to critical sectors and services.

Notably, in mid-2016, an attack targeting Indian banks led to the details of more than 3 million debit cards being breached. Around the same time, neighbouring Bangladesh saw a thwarted attack on its central bank result in the theft of US$81 million. If successful, the attack would have siphoned off close to US$1

billion — 0.5 percent of Bangladesh’s GDP at the time. A similar attack in July 2016 almost resulted in the theft of US$170 million from the accounts of the Union Bank of India. The frequency and sophistication of attacks has only increased in 2017 with ransomware waves including WannaCry and Petya disrupting commerce globally — including at India’s largest container port in Mumbai.

These and other incidents have fuelled policy intervention with sectoral regulators including the Reserve Bank of India, the Insurance Regulatory and Development Authority of India, and the Securities and Exchanges Board of India acting to issue circulars mandating implementation of cybersecurity frameworks by regulated entities. India’s Computer Emergency Response Team (CERT-In) has also publicly indicated that it intended to strictly enforce incident notification requirements contained under Indian IT law — applicable across sectors.

While many of these regulatory frameworks are comprehensive, much of the Indian private sector — not covered by sectoral frameworks — has struggled to adapt. In the face of threats from cyberspace, it has become mission critical for companies to not only take preventative measures to mitigate effects of attacks on operations but to also manage the attendant contractual, governance and regulatory risks.

Based on our observations of market practice, this note flags certain key areas of concern for companies going forward and suggests steps that can be taken to contain risk. As opposed to being an exhaustive list, it

“While businesses have been quick to realise the magnitude of risk posed by poor cybersecurity practices, many have been slow to implement frameworks and policies for mitigation, response, and remediation of security incidents”

Page 29: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

Cybersecurity Incidents: A roadmap for response and remediation

27 Volume 15 Issue 1, 2017

is intended to provide a starting point for companies embarking upon broader cybersecurity planning. While some observations and conclusions may be specific to the Indian scenario, most of our analysis would equally apply to other jurisdictions with nascent cybersecurity regulatory ecosystems.

Red flags for private sectorWhile businesses have been quick to realise the magnitude of risk posed by poor cybersecurity practices, many have been slow to implement frameworks and policies for mitigation, response and remediation of security incidents (‘security incident policies’). Where they have been implemented, most suffer from either critical or subtle deficiencies which undermine their effectiveness. Five common flaws we observed in the pre- and post-policy formulation process are as follows:• Lack of regulatory awareness: Thus far,

the Indian approach to cybersecurityregulation has been characterised by thecreation of various parallel bodies andagencies — often with overlappingmandates and jurisdictions. With such amultiplicity of regulatory frameworks andauthorities, combined with non-existentenforcement, it is easy (and common) forbusinesses to have incomplete awareness oftheir various compliance requirements. Thisis especially likely to be the case where nodesignated sectoral authority or bindingframework exists. In a post incidentscenario, where regulatory enforcement orconsumer action is possible, suchinformation asymmetries may prove fatal.

• Breach planning and preparedness: Mostbusiness (especially where no sectoralguidelines exist) do not have in placecomprehensive security incident responseand remediation policies or plans. The lackof such plans can open businesses — and

their directors — up to liability from consumers, shareholders/investors, partners and regulators. This is to be seen in the context of the growing realisation that it is unreasonable to expect all forms of attacks to be prevented. With this in mind, not putting in place and comprehensive framework is an inexcusable failure to mitigate potential liability.

• Lack of harmonised and holisticresponses: Even where businesses haveimplemented incident policies, they areoften narrowly tailored to apply to anentity’s technical and governancefunctions. Many policies make fatalomissions by not including other criticalstakeholders such as communications/PRand legal. In a post breach scenario, thelack of a uniform and harmonised response— both internally and externally — is acertain recipe for chaos.

• Failure to test: An incident response plan isonly valuable as the amount it has beenassimilated through drilling and testing. Inthe absence of regular security drillsinvolving all stakeholders in the decisionchain, the chances that a plan will not besuccessful in a critical scenario increasemanifold. Many businesses fail to realisethis by treating policies as one-off exercisesand make the mistake of assuming that themere presence of a plan is sufficient tomitigate liability. This is a critical mistakeas, in a contentious setting, corporateleadership may be called upon todemonstrate not only that there was a planin place but that awareness of it had

GV Anand Bhushan

“In the face of threats from cyberspace, it has become mission critical for companies to not only take preventative measures to mitigate effects of attacks on operations but to also manage the attendant contractual, governance and regulatory risks”

Page 30: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

CYBER CRIME & DATA PROTECTION REPORT

28 www.inhousecommunity.com

diffused into organisational culture through regular training and drilling.

• Failure to audit: The failure to audit can gut even the best of incident response plans. Without regular audits at pre- and post-policy formulation stages, businesses may risk policies that are either not sufficiently comprehensive or which are not externally validated for being in line with industry standards.

Other issues commonly observed include lack of cybersecurity capacity or, more broadly, awareness in an entity’s culture. Traditionally such issues are more likely to be associated with SMEs and businesses in non-technical sectors.

The way aheadThe problems above, if unaddressed, can not only lead to a policy that fails to properly account for the various threats in cyberspace, but one that can lead to failure to properly mitigate disruption to operations and legal liability. Below, we discuss some high-level steps that can be taken to ensure a more robust framework:• Compliance landscaping: In a post-breach

scenario, it is important to quickly head off potential sources of liability, comply with incident notification requirements and — where the incident is severe — proactively engage with regulators. However, a post-breach scenario does not afford the time to carry out a comprehensive survey of the applicable legal and regulatory frameworks. Therefore, a comprehensive — even if high-

“A key aspect of the security incident policy formulation process is identifying well in advance the constituents of the primacy incident response team and providing for clear authority, decision-trees and dedicated communication channels”

level — survey of applicable laws and regulations should precede or form part of every policy formulation exercise. Carrying out the exercise prior to policy formulation aids in effectively allocating responsibilities for different tasks such as notifying breaches and working with specific regulators.

• Broad-based policy formulation: The security incident policy-formulation process should ideally include all of an entity’s verticals and departments — to ensure ownership of responsibilities and engagement in the event of an incident. Typically, this should include representation of not only technical and governance functions but also legal, compliance, government affairs and communications/PR verticals to ensure preparedness for all types of potential fallout. External legal and communications consultants can also play a crucial role in the process — ensuring that legal and PR risk mitigation forms a core part of the policy’s DNA.

• Ensuring dedicated resources: A response and remediation policy is only as robust as the individuals implementing it. Many otherwise prepared businesses fail to maintain dedicated staffing for cybersecurity-related planning and response. Specialised staffing is required on the technical, legal, compliance and governance levels. Larger businesses may consider having dedicated in-house resources (either through hiring or repurposing through training) while smaller entities may find the use of external vendors and consultants more economical. In either scenario, a certain level of investment may be required as it must be duly recognised that existing internal IT teams — being more oriented towards administrative and maintenance functions — may not have the necessary skills or

Tarun Krishnakumar

Page 31: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

Cybersecurity Incidents: A roadmap for response and remediation

29 Volume 15 Issue 1, 2017

[email protected]@amsshardul.com

http://www.amsshardul.com

“Today, treating a cyber-attack as a black swan event is, at best, uninformed; at worst, negligent — and regardless of characterisation, wholly inadvisable”

bandwidth to address security incidents.• Pre-identified and empowered response

team: A key aspect of the security incidentpolicy formulation process is identifying —well in advance — the constituents of theprimacy incident response team andproviding for clear authority, decision-treesand dedicated communication channels. Asis the case in policy-formation (discussedabove), post incident remediation effortsshould typically include broad-basedrepresentation from not only technical andgovernance functions, but also legal,compliance, government affairs andcommunications/PR verticals to ensure thatall types of fallout are contained. Externaltechnical, legal and forensic serviceproviders must also be pre-identified andretained to avoid delays.

• Periodic data and security auditing: At theoutset, businesses must carry out audits tounderstand the various risks they may facein the normal course of operations. Inconsumer-facing businesses, the focus mustbe on comprehensive data auditing tounderstand the types of data collected andtheir sensitivity. Such a process aids riskprofiling, identifying threat vectors andgaps where risk can be mitigated at theoutset (for example, pseudonymisation oranonymisation of data) — all learningswhich ultimately contribute to an effectiveresponse and remediation policy.

• Drilling and penetration testing: Anessential component of a robust securityand incident framework is period stresstesting through drills for existing and newemployees — with an emphasis onindividuals and departments which haveresponsibilities under the policy. Suchdrilling should be accompanied by regularpenetration testing — ideally by externalconsultants — to identify vulnerabilities.While predominantly targeted at technicalissues, these should occasionally becombined with social engineering and spearphishing to account for human elements.

• Independent certification: Pursuingindependent audit and certification fromthird party agencies is an important stepwhich can demonstrate that measuresimplemented are commensurate withindustry standards and practices. In theIndian scenario, CERT-In undertakes the

function of empanelling of auditors to carry out security audits and investigations. However, there is no paucity of other quality cybersecurity service providers.

In addition to the above high-level measures, businesses should also look to imbibe cybersecurity concerns into standard operating risk. A key issue which may require to be addressed in this regard is factoring in cybersecurity into contractual relationships with consumers, vendors, or other partners. While existing contractual relationships may already be locked in, businesses should look to ensure that future iterations of standard terms adequately account for cybersecurity risks. An area where this can have a significant impact is where a security incident or attack substantially disrupts mission critical operations. In such a setting, contractual recognition of cyberattacks as a valid ground to declare force majeure may mean the difference between continuity of the relationship and termination followed by liability. Similar concerns arise in relation to non-disclosure-agreements.

All factors considered, cybersecurity risk is here to stay. Today, treating a cyber-attack as a black swan event is, at best, uninformed; at worst, negligent — and regardless of characterisation, wholly inadvisable. The sooner businesses begin to treat cybersecurity incidents on par with other shocks to supply and demand, the more likely that the legal and reputational butterfly effects of such incidents can be minimised, if not eliminated.

Page 32: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

SPECIAL FEATURE

30 www.inhousecommunity.com

By Kenny Tung

How the challenges of cybersecurity reflect those in the legal profession

Cybersecurity used to be viewed as black magic. From a non-technical, user or customer perspective, most people are happy that the IT folks

“just make it work” and “no news is good news”.

This sentiment is familiar to lawyers, who are commonly viewed as someone to call when things go wrong; keepers of checklists of past experience; the person to sweat the details in a dispute or complex negotiation. And who are to be avoided in most other situations.

In a recent McKinsey podcast, Nathaniel Gleicher, head of cybersecurity at Illumio, raised a number of challenges facing the cybersecurity industry that echo many of the challenges facing legal professionals.

ComplexityThe recent change in the perception of cybersecurity has evolved due to the increasing scope and scale of breaches, organisations’ move into exposed environments and the emerging internet of things.

Gleicher observed that if we made cars the ways we make computers and software, they would go 800 kilometres an hour, travel 200 kilometres on a litre of fuel and blow up once a week. In the cyber world, surprisingly small software bugs are increasingly capable of causing significant physical chain effects.

Legal environments are also getting more complex. There are more regulations, globalisation is driving greater cross-border complexity, changes to rules are happening faster and more frequently, rule-making is routinely falling behind macro drivers amid turbulent socio-economic and technological shifts, and corporations are routinely being targeted by social discontent as society demands a higher bar for compliance. On top of these challenges, social media amplifies the threat of reputational risk.

In response to this threat environment, cybersecurity professionals are increasingly expected to quantify the risks and measure the benefits of their solutions. Likewise, today’s clients of legal services expect analysis and insights from data, and demand solutions to legal issues to be based on what lawyers know and not just what they think.

Strategic failureYet Gleicher complains that the cybersecurity market can sometimes act like a group of fourth graders playing soccer — the whole bunch chasing the ball across the field rather than playing a coordinated game with big-picture coverage. Hot topics and best practices — encrypting data, strong passwords, whitelisting apps, segment environment, patching vulnerabilities — do surface but are not generally in practice because of the challenges of accomplishing them in scale across large organisations.

By the same token, lawyers continue to value legal complexity above solving for business problems. Billing hours aside, their reason for existence is mostly about the latest case, rule making and gossip. Best practices are talked about but not often put into practice, mostly due to the culture of practising law for the sake of jurisprudence, lack of law savviness among clients and general dearth of progress in the development of lawyers as T-shaped professionals to solve problems holistically across organisational silos.

The main cybersecurity challenge today concerns the lack of a single coherent strategic model that prescribes how to protect an environment. While many tactical models exist, companies are starting to figure out how to see the threat as a whole.

Most companies do not have, or have not known, a corporate legal strategy that is integral to the business/corporate strategy.

Page 33: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

How the challenges of cybersecurity reflect those in the legal profession

31 Volume 15 Issue 1, 2017

Legal strategies come up mainly in major disputes, rule-making with significant impact on an industry or bet-the-farm transactions.

Understanding the environmentIn principle, the foundation of every security discipline is to understand the environment to protect and exert control, such as prevention of access, detection and response over the environment. But yet when it comes to cybersecurity, most organisations live with a general lack of clarity in defining what is the network, what is connected to what and where high value assets are. As a result, they end up with relatively few options to control the environment, and are found defending an open field, stuck in a reactive position to attackers’ moves.

In the legal space, most lawyers work at their desks, even if they are considered to be co-located with their clients. A majority rarely work across the corporate silos despite the fact that the legal function supports every business unit and function. Few lawyers have close up and thorough appreciation of what their colleagues and internal clients do or what their vital interests are. Even fewer are engaged with the client at the strategic level and are usually called upon only after something has gone terribly wrong or opportunities for an easier solution were missed, leaving no option but to call in the clean-up team. At that stage, whether in dispute resolution or an

investigation, it is convenient to shift part of the responsibility to the legal team if the outcome is unsatisfactory. This is all too common when we stand at the threshold of an era where compliance is called upon to graduate from being aspirational to strategic and from remedial to preventive.1

Better detection and response in cybersecurity starts with understanding the environment — the business risks, assets that the corporate strategy, initiatives and operations rely on, which, if exposed or compromised, would fundamentally harm ways of doing business. Take how the secret service protects the U.S. President before a speech in an auditorium (an open environment). The main exercise is to reduce the number of attack angles to monitor by restricting public access, thus simplifying the environment to control, which makes detection much easier — managing the false positives and false negatives, making breaches more obvious and enabling speedy reaction, prioritising alerts of threat to highest value assets.

Similar considerations call for practising preventive law and even helping to drive corporate and business strategies. Beyond conversations with the business folks in canteens, to truly appreciate the business environment and risks, lawyers should regularly walk the shop floors, join sales calls, meetings with suppliers, product development gate conferences and generally maintain an immersive experience with business processes where legal input may matter. This will enable legal to start looking at risks as a whole or a portfolio, in a measured, prioritised and practical manner. In addition to connecting opportunities with commensurate risks, we will look at risk management in terms of minimising false positives that will overwhelm limited resources, and false negatives that will shift

“The cybersecurity market can sometimes act like a group of fourth graders playing soccer — the whole bunch chasing the ball across the field rather than playing a coordinated game with big-picture coverage”

Page 34: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

SPECIAL FEATURE

32 www.inhousecommunity.com

the focus of solutions away from the legal function and damage, or even end, the organisation. All must be grounded on the organisation’s strategic priorities and negotiated across people-process-system — also known as corporate culture.

Organisational solutionsCybersecurity is an organisational solution, not just a response to a technical problem. There are many touch points — computers, systems, employees and third parties. Applying the basic security hygiene (passcodes, basic caution in cyber activities and people control) at all chinks in the armour will eliminate half of the problems. As with other areas of compliance, everyone has a role to play.

The modernised legal function starts with deriving a living corporate legal strategy from the organisation’s strategy, to serve as basis for legal decision making and solutions, especially in an era of precise interaction based on data analysis. Starting with streamlining legal work processes and automating tasks that were previously thought to be bespoke and uniquely handled, lawyers, like every function, will leverage change management to tackle a more complex environment by simplifying it rather than resorting to pure legal complexity and uncertainty. This means shifting our own and other’s expectation on what the modern legal function can achieve and playing a part to link up resources and insights across businesses and functions. This mission for the legal function is not a nice-to-have, but is critical for the

[email protected]

www.iglegalytics.com/

Kenny Tung has been advising companies on strategic projects and transactions through Lex Sigma. He also co-founded In-Gear Legalytics to serve providers, clients developers and investors in the legal service value net. Previously Kenny served as the chief legal counsel of Geely Holding and before that as the general counsel in Greater China or Asia at a number of multinationals that are also household names.

Beyond conversations with the business folks in canteens, to truly appreciate the business environment and risks, lawyers should regularly walk the shop floors, join sales calls, meetings with suppliers, product development gate conferences and generally maintain an immersive experience with business processes where legal input may matter

function to be ready to work with the “internet of legal things”, working with clients and designing an environment that addresses problems faster, better and within commensurate costs.

As with other changes, a successful legal function transformation is prescribed by the four Cs across an organisation:• Command — From a top-down leadership to

drive change which rests with interdisciplinary cooperation and a common purpose, not just a legal department project;

• Connection — With the strategy to shape and sustain a business model to satisfy customer needs — not technology for technology’s sake — and ultimately with the customer’s value proposition;

• Culture (and Capability) — Especially toward collaboration and creativity in problem solving in a digital world, and more proactive thinking like an enterprise owner;

• Commitment — To stay the course as transformation requires alignment of disparate interests and keeping an eye on moving the needle over twists and turns.

While the legal profession is no exception in the need to leverage technology to keep up with how the world works, when it comes to working with people and their relationship with their organizations and the world, lawyers can return to the roots of their expertise which is not just the law but the underlying relationship impacting parties who are ultimately human.

End Note:1. “Five Currents Pointing To Compliance As A Strategic

Function,” Kenneth Tung, Linkedin Post, May 17, 2017; first published in Compliance Elliance Journal, Volume 3, Number 1, 2017.

Page 35: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

33 Volume 15 Issue 1, 2017

Visionary International Law Firm Winner: Eversheds

The past year has marked a defining period for Eversheds as the firm reached a critical mass in Greater China,

across Asia more generally, and the world.One of its signature innovations in Asia emerged in Hong

Kong in October at the inaugural summit of the Eversheds Asia-Pacific Alliance — an initiative led by Asia managing partner Stephen Kitts. The alliance provides clients with access to 20 of the leading firms in Asia Pacific and takes the traditional concept of a best-friend network into a much more client-focused direction, with Eversheds assuming all responsibility for client service, quality of legal advice, billing and other practices, meaning that clients only have to deal with one Eversheds contact for instructions, billing and service enquiries — and only receive one bill regardless of the number of jurisdictions involved in a matter.

Another innovation came from the Asia employment team, which launched an app to help clients keep abreast of the increasingly frequent changes to laws and regulations across the many countries in the region. Written in plain English, it allows users to compare laws in different jurisdictions, access information while out of the office and share with colleagues.

In terms of client matters, the firm advised on the extremely complex and ground-breaking US$40 million Falcon Ma’an solar photovoltaic power project in Jordan, and the funding and construction of the US$3.15 billion Facility D integrated water and power project in Qatar, featuring a fully customised procurement programme.

Christine Tam and Peter Gregoire, AIG Insurance

Introducing the winners of this year’s awards to recognise legal providers

that go above and beyond in the service of their clients.

Visionary External Providers of the Year 2017

The importance of client service lay at the heart of our thinking when putting together the criteria for the Visionary External Providers of the Year. That, and the importance of reflecting the changing landscape of legal services, which is no longer the sole preserve of the legal partnership structure.

General counsel have shared with the In-House Community that the three prevailing challenges they face on a day-to-day basis are: managing costs and evaluating value-added; talent and career management; and positioning the legal department within the company.

By reverse-engineering these key challenges, we asked legal service providers — from anywhere on the new spectrum of legal services — to demonstrate that they can truly stand inside the shoes of their clients and provide them with inspiring service. So, rather than asking firms how much

they pay their senior equity partners, we asked them to quantifiably demonstrate the following:• budget-orientated project management for a client;• advice to a client regarding productivity and

efficiency; and• exceeding client expectations (inclusive of client

testimonials).The awards were judged by David Miles and Evangelos Apostolou. A seasoned legal professional, Apostolou was general counsel, Asia Pacific, and partner, Ernst & Young; and general counsel, Asia Pacific, British Telecom. He is currently president for EMEA at SirionLabs. Miles is a former partner, executive committee member and Asia chairman for Latham & Watkins. He is currently chairman of Asia Community Venture.

Matthew Kendrick of Daimler China presents the Visionary International Law Firm of the Year award to

Veronique Marquis of Eversheds

Page 36: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

34 www.inhousecommunity.com

It agreed a deal to merge in Singapore with Harry Elias Partnership to create a firm with more than 90 fee-earners, including 26 partners, and offices in Singapore and Brunei, making it one of the largest international firms in Singapore. It also boosted headcount in China by over 23 percent — at a time when some international law firms are retreating.

More broadly, the combination between Eversheds and US-based Sutherland Asbill and Brennan was the largest law firm merger of 2016, creating a truly global player with over 4,000 employees, including more than 700 partners, and 62 offices in 30 countries.

Visionary Law Firm Asia Winner: Yulchon

Korea’s Yulchon earns this recognition thanks to its deliberate development of a culture of innovation and

collaboration, which have long been hallmarks of its approach to legal service.

On the tech front, the firm offers a platform of interactive mobile applications that are aimed at delivering cost-effective solutions for clients. In particular, the eYulchon platform addresses some key structural issues of client-law firm engagement, such as the hidden-cost problem. The firm offers a series of apps, for example, that clarify business issues before elevating a matter to the in-house lawyers, reducing the time — and therefore the hidden cost — that the legal team needs to spend understanding an issue.

Yulchon has also demonstrated its willingness and ability to structure advice to a budget, including a recent case where it recovered claims against Lehman Brothers on a success-fee basis after the clients were ready to abandon the case due to the lengthy, expensive and unsuccessful efforts of the original deal team. Yulchon delivered a

substantial recovery in just two months.Teamwork and collaboration across multiple disciplines

allow the firm to design innovative solutions to even the most complex matters. Involving the expertise and experience of professionals from the firm’s M&A, finance, tax, antitrust, real estate, IP and labour practice groups, the firm helped one client navigate Asia’s largest ever leveraged buy-out transaction and Korea’s largest M&A transaction to date — MBK Partners’s US$6.1 billion acquisition of Homeplus, Tesco’s Korean retail business.

Visionary Legal Services Provider – Non-Law Firm Winner: KorumLegal

KorumLegal is a boutique legal consultancy that delivers on its promise of providing innovative, flexible and

client-centric legal services. Its solutions cover people, processes and technology — such as secondments, legal consulting and legaltech solutions — in a way that is focused on providing value for clients. “We don’t have ivory towers and therefore don’t charge traditional law firm rates,” it says. “We offer fixed rates which are at least 50% better value than law firms.”

The self-funded startup’s founding principle is to disrupt a legal services industry that continues to be expensive, inaccessible and complex. It has embraced technology such as cloud infrastructure, customer relationship management systems, data analytics and artificial intelligence to enable its “lean law” model.

“The team at KorumLegal offers a unique model in the delivery of legal services,” said Jeremy Platt, chief compliance officer at Zwoop, a tech startup that hired Korum to help with its establishment, review its business model for launch and act as virtual in-house counsel. “They are flexible in their engagement and provide special value

Yong-Pyo Yeom of Yulchon is presented with the Visionary Law Firm Asia award by Matthew Kendrick

Visionary Legal Services Provider – non-law firm: KorumLegal’s Titus Rahiri (right) receives the award from Matthew Kendrick of Daimler China

Page 37: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

35 Volume 15 Issue 1, 2017

without any sacrifice to quality. Backed by years of experience, KorumLegal consultants understand the challenges faced by start-ups.”

Korum’s model allows it to provide the kind of service that big law firms rarely can — for example, legal consultants who are senior, flexible and not prohibitively

Yozua Makes (right) receives the External Counsel of the Year – South Asia award from David Miles

expensive — and it can do this thanks to low overheads and a nimble, bespoke approach. Providing value is its core mission.

External Counsel of the Year – South Asia Winner: Yozua Makes of Makes & Partners

Yozua Makes, the founder and managing partner of Makes & Partners, was chosen as External Counsel of the Year –

South Asia, by in-house counsel who took part in the voting. “Yozua Makes provides a great service,” said one respondent, while another added: “Makes and his team don’t just solve current problems, but as much as possible, also mitigate potential future issues.”

Most Responsive Firm of the Year Winner: Baker McKenzie

Baker McKenzie was the overwhelming winner in this category, having been voted most responsive firm by

in-house counsel in China, Indonesia, Japan, Malaysia, Philippines, Singapore, Thailand and Vietnam.

Confused as to where to start your search for external counsel across the Asia-mena region?

What’s more ...Just tell us what area, and where you are looking for advice, and based on feedback provided by our 20,000+ members across the Asia-mena region, as well as our personal knowledge of the market, we’ll be happy to give you a shortlist of firms or counsel to start your search with.

For more, contact Tim Gilkison [email protected]

You can start your search at:

www.inhousecommunity.com/find-a-lawyer/

Page 38: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

The thing about …

ASIAN-MENA COUNSEL: As Shook Lin & Bok comes close to its 100th anniversary, do you think that Yong Shook Lin, the firm’s founding partner, would approve of the work and the values of the present firm in Malaysia?Nagarajah Muttiah: The firm has grown from strength to strength since its inception as a sole proprietorship. Although much has changed over the years — our office shifted three times before we finally settled; we were part of the evolution from aerogram to email and from switchboard operators to iPhones — the firm still maintains the values and ethics that formed the very core of Shook Lin & Bok. And for that reason, we managed to keep close bonds with clients who have been with us for decades long. As the nation’s economic landscape changed, the firm’s practice areas expanded from simple conveyancing and litigation in our early years to today’s full-service offerings handled by 17 specialist departments. The expansion is to cater for more sophisticated industry needs. We also continued to fuel the aspirations of young lawyers, many of whom eventually led distinguished legal careers and made

As we come close to the firm’s centenary, Asian-

mena Counsel’s Patrick Dransfield photographed and

interviewed Nagarajah Muttiah, the managing partner of

Shook Lin & Bok (Malaysia) and also put to him a series of

questions on behalf of the In-House Community.

outstanding contributions to the industry and society. I believe that Yong would be pleased to know that we have kept his principles and values alive through the years.

AMC: What is the history of Shook Lin & Bok Singapore?NM: The firm started as a sole proprietorship in 1918 and was renamed as Messrs Shook Lin & Bok, as it is presently known, when Tan Teow Bok joined our founder, Yong Shook Lin, in 1938. In 1952, Yong Pung How, the son of our firm’s founder joined the firm as a lawyer and subsequently took over the helm as the managing partner in 1956 after his father’s passing. During the early 1960s, the firm got involved in a lot of work for the banking and financial community, both in Malaysia and Singapore. So the younger Yong decided to set up a Singapore office as part of a strategic effort to create a pan-Asian law firm post Malaysia’s independence in 1957. After all, quoting Yong Pung How: “Singapore was meant to be the New York and Kuala Lumpur the Washington,” during that time. The firm has an established camaraderie with our Singaporean

36 www.inhousecommunity.com

Asian-mena Counsel Q&A

Page 39: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

Nagarajah Muttiah

“It is now imperative for the legal industry to stay abreast and be acutely aware of the role technology plays in all industries, from process implementation to the delivery of products and services”

The thing about … Nagarajah Muttiah

37 Volume 15 Issue 1, 2017

Page 40: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

lawyers skilled in the dual disciplines of conventional finance and Islamic finance. The fully integrated nature of our banking and finance practice involves strong alliance between the corporate, banking and finance, banking and finance litigation, as well as the loan and debt restructuring departments in seeing our clients through all weathers.We maintain close ties with our Singaporean counterpart and continue to build solid relationships with regional and international law firms through active professional and social engagements. The cordiality of relations and mutual understanding between the firm and our peers has been a boon in this rapidly globalised world we live in.

Speaking of active professional and social engagements, Shook Lin & Bok is proud to have three Malaysian Bar Council presidents, a Singapore Chief Justice and a good number of highly regarded legal practitioners as part of our rich heritage. Clients have long leveraged on our integrity and professionalism to achieve intended business results and bring amicable resolution to disputes. We have held on to these values resolutely and I think the firm has enjoyed healthy organic growth over the years because of this. However, players within the Asean region are still adjusting to the deregulation of trade barriers to legal services. This has posed a myriad of unique challenges such as the understanding of Asean’s complex legal systems, which includes common law, civil law, socialist law and sharia law.

AMC: Your own expertise relates to maritime and insurance. Do you still maintain your practice? Is the legal industry keeping pace with the recent technological developments of the insurance industry?NM: Yes, I am still very much involved in the practice of maritime and insurance law on both the civil litigation and arbitration fronts. The legal industry in Malaysia is actively learning and exploring the multitude of technologies and technological innovations that could serve as an enabler for us to sync more efficiently with other industries, including the insurance industry. I would say that the local insurance industry takes a bolder stance in adopting technological innovations in its processes while the legal industry is incrementally assimilating technology into our work. We are growing in tandem, with legal tech being more

counterpart ever since whilst remaining distinct and independent enterprises.

AMC: At the beginning of your career, how was the in-house community at that time? How has the in-house legal community developed? Are there special challenges facing Malaysian in-house counsel?NM: The in-house community in Malaysia when I just started practising was very modest, and that may be a fair reflection considering the smaller number of lawyers at the time. The community morphed in tandem with the country’s economy from the late 1980s onwards, prompting the firm to simultaneously develop and diversify our practice areas to cater for the increasing sophistication of our clients. We began to strengthen our dispute resolution practice in addition to polishing our well established corporate, commercial and conveyancing practices. This initiative corresponded to the needs of the in-house legal community as the economic slowdown in the 80s and 90s gave rise to an increase in banking and corporate recovery litigation.Today, the in-house community in Malaysia is more multifarious, cosmopolitan and dynamic than ever before. Modern organisations tend to prefer keeping a leaner team of in-house counsels who are expected to also play the role of strategic advisers — to manage commercial and legal risks and are required to meet business expectations; expertise of which are beyond the scope of a traditional in-house counsel. One of the greatest challenges faced by Malaysian in-house counsels in recent times would be regulatory compliance, given the increasing volume and complexity of legislations and regulations, and I presume that to be the case across the board for most, if not all, in-house legal counsels within the region.

AMC: In what ways does Shook Lin & Bok attempt to provide an integrated service for clients and how do you link up with other law firms, both regionally and internationally?NM: Shook Lin & Bok provides clients with a fully integrated service offering whereby our litigation and non-litigation teams collaborate seamlessly to help clients pre-empt, manage and resolve matters. For instance, our banking and finance practice encompasses a broad spectrum of expertise which adopts a holistic approach to its advisory role, with its team of

38 www.inhousecommunity.com

Asian-mena Counsel Q&A

Page 41: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

conscientiously regulated because of the nature of our work to “uphold an enduring and stable system of rules around which society can structure its interactions”, as quoted from the speech of Singapore’s Chief Justice Sundaresh Menon at the opening of the legal year 2017.It is now imperative for the legal industry to stay abreast and be acutely aware of the role technology plays in all industries, from process implementation to the delivery of products and services. This knowledge is essential for legal advisers to ensure all regulatory and commercial requirements are met and stakeholders’ interests protected. As a firm, we are always tuned in on technology developments around us and have dedicated a technology, multimedia and telecommunications law department to complement our existing services and to better cater for the changing industry needs.

AMC: Malaysia is the world’s biggest centre for Islamic finance. What do you see regarding the opportunities and challenges in this area and is this a priority for the firm?NM: Malaysia has come a long way since Islamic finance was introduced in the country back in the 1970s. The first Islamic bank was instituted through the enactment of the Islamic Banking Act 1983, and we have since stood witness to a blossoming Islamic finance industry with the liberalisation of the Islamic financial system. Shook Lin & Bok’s heritage is closely intertwined with the nation’s banking industry with many of our partners, past and present, having contributed to the development and advancement of the banking industry over the years through professional involvement in regulatory bodies, corporate organisations, educational institutions and think-tanks relating to both conventional and Islamic banking.Islamic finance still has tremendous potential for growth regionally and internationally. As Islamic finance is rapidly taking prominence in the global financial market, conventional financial institutions face heightened competition. This has spurred a challenge for firms to keep up with the innovative product offerings and tectonic structural changes in the finance sphere, alongside the new commercial and legal concerns that manifest thereof. Nevertheless, Malaysia’s experience in building a thriving domestic Islamic financial industry creates excellent opportunities for the firm to

“We engage with our current and new

clients alike with integrity and respect. The advancement in

technology has allowed clients to

engage us through various modes of

communication, be it online or offline. It really depends on our

clients’ preferred mode of engagement

and what works best for them”

showcase our expertise in the dual disciplines of Islamic finance and conventional finance. The capability to take a holistic approach in handling litigious and non-litigious banking and finance matters allowed us to further leverage on our Islamic finance knowledge and experience, making it one of the firm’s organic priorities.

AMC: How should a major new client engage with Shook Lin & Bok to ensure the best results? Is the firm offering any special arrangements beyond the usual?NM: We engage with our current and new clients alike with integrity and respect. The advancement in technology has allowed clients to engage us through various modes of communication, be it online or offline. It really depends on our clients’ preferred mode of engagement and what works best for them.As we have a highly diversified portfolio handled by 17 specialist departments, the firm is able to provide holistic services through cross-departmental collaborations. For instance, our teams from the banking and finance department, debt and loan restructuring department, banking and finance litigation department and general and civil litigation department were mobilised to act and advise a client on a complex high-stakes matter involving a settlement arrangement with multiple corporate debtors. As a unique proposition, our specialist departments work in collaborative environments where our clients

The thing about … Nagarajah Muttiah

39 Volume 15 Issue 1, 2017

Page 42: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

Nagarajah Muttiah is the firm’s current managing partner and heads the general and civil litigation department, the inter-national and domestic arbitration depart-ment, and the shipping and insurance department. He was called to the English Bar in 1979 and was subsequently called to the Malaysian Bar in 1980.

Muttiah authored the Malaysian chapter to the second edition of William Tetley’s Maritime Liens and Claims. Amongst other notable achievements and affiliations, he is the immediate past president and is now a committee member of the Malaysian Maritime Law Association. He has presented a number of papers over the years as a member of the International Bar Association and the International Pacific Bar Association.

Known for his work in the insurance industry, Muttiah and his team of lawyers regularly handle complex insurance and reinsurance disputes. Recently, he and his team led negotiations on behalf of a leading Malaysian insurer with a leading reinsurer from the Middle East and the Labuan Offshore Financial Services Authority of Malaysia (LOFSA), which finally culminated in a landmark out-of-court settlement agreement between the parties premised on commutation clauses found in the motor quota share treaties.

Muttiah is an active practitioner in the areas of international and domestic arbitration and has previously acted as an arbitrator. He is also a familiar personality in all levels of the Malaysian court, including the Court of Appeal and the Federal Court, and frequently appears as counsel for intricate or complex cases.

reap the full benefits of engaging professional legal services.

AMC: Our belief is that successful training should produce lawyers who can be at the top of their game, where knowledge of the law and a profound grasp of professional ethics and integrity, as well as the necessary commercial acumen to be your own boss, are embedded in the DNA. What is Shook Lin & Bok’s approach to training?NM: Shook Lin & Bok has always been an advocate for continuous professional development, so the notion stated is pretty reflective of our position on training for lawyers. The firm provides our lawyers ample platforms to upskill through the frequent organisation of internal dialogues and seminars apart from opportunities to participate in conferences and workshops, both locally and internationally.

Work-life balance has been a buzzword for millennials joining the workforce, and the same is the case for the newer generation in the firm. The firm takes into serious account the welfare of our people and strives to provide them with the necessary support to attain what they have set out to achieve. Of course, the legal profession tends to project a more solemn outlook compared to the tech industry, for instance, but our collaborative culture and open-door approach have been key to sustaining the balance that our younger generation seeks.

AMC: What is your hinterland (ie, what are your interests outside of the firm)? How do you control your time so that you can pursue them?NM: Well, the black and white theme seems to be consistent throughout my vocation and avocation. I have a passion in photography, black and white photography to be exact. I have always been fascinated by the intricacy of architectural structures and the history behind them. Photographs in black and white give them a classic and timeless quality. Many a times, the focus of the photograph becomes clearer without the distraction of colours. It is an interest that I have kept for years yet still find myself very much intrigued by the monochromatic outlook. The best part is this hobby doesn’t take up much time, especially when beautiful shots can be created spontaneously with just a click of the shutter. All that matters is our perspective.

40 www.inhousecommunity.com

Asian-mena Counsel Q&A

Page 43: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

A former private practice lawyer who had spent his entire

career in major international financial centres, Robin Scott

discusses his transition to an in-house role in one of the

world’s most exciting frontier economies: Myanmar.

ASIAN-MENA COUNSEL: Can you describe your professional background and your current role?Robin Scott: Until moving to Myanmar, my entire career was with Freshfields Bruckhaus Deringer in London, New York and then Hong Kong. In 2012, I was working in the corporate department in Hong Kong as the democratic transition in Myanmar was taking shape. The EU and the US had just suspended sanctions and some of our multinational clients were considering entering or re-entering the market. I advised one client, a multi-national manufacturer, to obtain its permit from the Myanmar Investment Commission and set up its Myanmar operations. Over the next 18 months, I advised several other clients on their investments in Myanmar. Through my Myanmar contacts, I was introduced to City Mart Holding (CMHL). They were looking to establish a legal department as they were beginning discussions with International Finance Corporation, part of the World Bank Group, about financing. I made the move from Freshfields to CMHL in May 2014.

CMHL is the market-leader in the retail sector in Myanmar. It operates brands across the country including Ocean hypermarkets, City Mart and Marketplace supermarkets, Seasons bakeries and City Care health and beauty stores. One of CMHL’s aims is to be the first-choice partner for international companies investing in Myanmar. A large part of my role is therefore setting up these arrangements, from financing deals such as our IFC partnership, to joint ventures, such as our partnership with the Jardine group to

Robin Scott

operate Pizza Hut restaurants. I am also tasked with implementing international standards of compliance and corporate governance within the group. On the day-to-day level, I deal with all legal and contractual matters from leases for new stores to protecting our intellectual property rights.

AMC: How big is the team you manage and how is it structured?RS: Having even one in-house lawyer is a relatively new concept for most Myanmar businesses therefore we need to operate on a lean basis. I am supported by a very senior Myanmar lawyer, Daw Phyu Phyu Chone, and between us we manage all legal matters for the group. I take the lead on international

Robin Scott

41 Volume 15 Issue 1, 2017

In-House Insight

Page 44: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

In many ways, building the legal team from scratch has been easier than reforming an existing team. As a new department, we were not stepping on any toes and could clearly define our role and responsibilities

transactions while Daw Phyu Phyu Chone handles local matters, such as property transactions and employment issues.

AMC: What are the biggest challenges facing an in-house lawyer in Myanmar?RS: Myanmar’s decades of isolation from other countries has resulted in a unique business and legal culture. It’s not enough to know the law: lawyers here also need to understand how the government departments actually operate in practice. Coming from highly developed jurisdictions, it can be frustrating having so much uncertainty. Another challenge is that the rule of law was not valued during the long period of military rule. Instead of relying on formal contracts, the business culture in Myanmar has traditionally focused on personal relationships. With the influx of foreign investors this approach is now having to change.

AMC: What attracted you to working in a frontier market?RS: I was attracted to Myanmar in particular because of the huge potential the country offers in all sectors. It has always been a

resource-rich country but remains extremely under-developed because of its political situation since the end of colonial times. I am excited to be witnessing the very start of its transition to a democratic, open society. Many of the transactions I work on have never been done before in the country so it is not possible to just pull a precedent off the shelf. Learning how to put together a deal from the ground up, working out how international practices can fit within Myanmar law, has been a fascinating learning experience for me.

AMC: What are the most important qualities of a good general counsel?RS: Myanmar is such a dynamic market that it is essential that a general counsel understands not only the current business but also the plans and strategies that are developing. Generally other managers here are not used to working in a modern business structure and they do not always involve the legal team as early as they should. My role is therefore to be close to their business planning so that I can proactively assist them to structure their new ventures as efficiently as possible and help them to identify risks.

AMC: How have you found the experience of building a legal team from scratch?RS: In many ways, building the legal team from scratch has been easier than reforming an existing team. As a new department, we were not stepping on any toes and could clearly define our role and responsibilities from the start. We put in a lot of effort to educate other managers about the benefits of having a legal team and how we are here to help, and not hold back, the business.

AMC: How important have external firms been and has your perception of them changed since moving in-house?RS: I have good relationships with many firms in Yangon, mainly through the British Chamber of Commerce Myanmar, of which I am a director. Through the Chamber’s Legal Working Group, in-house and private practice lawyers meet frequently to discuss new legal developments. My experience in-house has allowed me to identify private practice lawyers who really understand the business sectors in which they work. High level, technical legal skills are not useful to

42 www.inhousecommunity.com

In-House Insight

Page 45: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

businesses here unless they are accompanied by a strong commercial sense which allows the legal advice to be put into the local context.

AMC: What is your outlook for how the legal market will develop in Myanmar?RS: A strong legal market is essential for Myanmar’s development. Investment will not flow as freely if investors are uncomfortable with the legal risks. The legal market is responsible for understanding these risks and giving clear advice to investors. For this reason, the strength of the legal market will mirror the broader economy. Myanmar has a good chance of high single-digit or even double-digit GDP growth over the coming years. I expect the corporate and commercial legal market to grow at a corresponding rate.

AMC: What advice can you give to young lawyers starting out in their careers today?RS: My key advice is to remain as open-minded and curious as possible. Very few international lawyers in Myanmar would have predicted, at the beginning of our careers, that we would be participating in the early stages of the reform of such an interesting

and promising country. Patiently developing the core legal skills while identifying what areas you are most interested in, can lead to many fascinating opportunities.

AMC: What skills should they aim to acquire and what are the most promising areas of practice to focus on?RS: I don’t think it is wise to specialise too early. Try as many different areas and acquire as wide a variety of skills as possible until you discover what interests you. The most promising practice area for each lawyer will be the one he or she is most interested in.

AMC: What is your hinterland — what are your interests outside of the legal profession?RS: Compared to just five years ago, there are now many more extra-curricular options for Yangon expats. I try to play sport as much as possible, tennis and golf during the dry season and hockey and running year-round. If I have time, I get out of Yangon to explore further afield. More and more areas of Myanmar are being opened to travellers and it is fascinating to experience places that have been off-limits to tourists for decades.

Note: The inaugural In-House Community Congress Yangon will take place at the Sule Shangri-La on November 21st, featuring practice workshops and thought-leading discussion. For more information on the gathering contact Tim Gilkison at [email protected]

Robin Scott

43 Volume 15 Issue 1, 2017

Page 46: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

SPECIAL FEATURE

44 www.inhousecommunity.com

By Nishant Choudhary, senior legal adviser, DFDL

Myanmar – Microfinance institutions and their obligations under the 2016 notifications:

Do we now have the necessary framework?

BackgroundIn light of the recent Notification No 1 of 2016 dated August 29, 2016, issued by the Microfinance Business Supervisory Committee (MBSC), its follow-up clarification Letter No. Ka Ka- 1/6 (180/2016) dated December 14, 2016 and Notification 3 of 2016 dated August 29, 2016 (collectively the Notifications) on Consumer Protection and prevention of over-indebtedness, there is a pressing need for additional guidance on the practicalities of compliance by Microfinance Institutions (MFIs). Further clarification is required on the implementation, scope and reach of these Notifications and the extent of their interaction with applicable laws, such as the Evidence Act, insolvency laws, Consumer Protection Law, and the Contract Act, along with more archaic laws such as the Usurious Loans Act of 1918.

NotificationsThe Notifications were issued with the intention of fostering fair business practice methods to be adopted by MFIs principally to safeguard MFI clients (predominantly from lower income groups) against potential predatory lending practices. The central aims are focused on the development of an ethical, socially responsible, and viable MFI sector. Nonetheless, certain thorny issues and areas of ambiguity persist in terms of interpreting these Notifications. Given their stated objectives, and the importance of successfully navigating any areas lacking sufficient clarity, we will now parse and analyse some of these issues in broader detail:

1) Notification 1/2016 read with Letter No. Ka Ka- 1/6 (180/2016) requires MFIs to comply with certain client protection principles, such as: the prevention of over-indebtedness, responsible pricing, fair and respectable treatment of clients and data privacy. Practical concerns on the subject of compliance include the following:a. Over-indebtedness: The Notifications do

not provide a clear ratio or definition of what constitutes over-indebtedness. Nor do they factor in how MFIs may gather information on clients’ actual credit situation. This remains a stubborn concern in the absence of any uniform or official credit history of the clients. MFIs may be forced to rely on un-official data from other local individuals residing in a given area or a statement provided by the loan recipient itself. At present there exists no mechanism to authenticate such information. Consequently, this renders MFIs prone to defaulting on their compliance obligations and their duty to clients, placed in the unedifying position of having to bear the responsibility solely.

b. Transparency: The requirements of these Notifications cannot be read in isolation. They are enmeshed with other terms of the Notifications itself, along with provisions of Myanmar laws, in order to aid it in achieving its stated ends. The provision of loan terms such as the loan amount, repayment schedule, interest rates, penalty fees, administration fees, and service charges in Burmese is a

Page 47: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

Myanmar – Microfinance institutions and their obligations

45 Volume 15 Issue 1, 2017

welcome change. Yet, problems persist in terms of comprehension on the part of clients. The majority of MFI clients come from underprivileged groups unable to read or write even in their own local languages. Nonetheless, they are forced to agree to terms and statements imputing their full comprehension of the loan agreement. There if no mechanism to validate clients’ understanding of the agreements that they enter into.

c. Responsible pricing: This is a welcome step, although the Supervisory Committee, in reserving for itself the power to prescribe applicable fees and other official charges, may become an obstacle to effective and ethical financing. This is particularly so given the variance of financing costs for the MFIs based on the spectrum of lenders and regions in which they operate. MFI loans continue to be unsecured with high operational costs attached. Most of the loans obtained by MFIs for on-lending are similarly unsecured are not cheap. In such a situation a prescribed rate of fees by the Supervisory Committee may stand as an impediment for financing, if it does not factor in the real financing costs that these MFIs must bear.

d. Fair and respectable treatment to clients: This requirement could well be interpreted as bringing MFIs under a fiduciary relationship, a relationship of care and protection towards their clients, to prevent harmful behavior towards MFI clients. However, the Notification fails to define exactly what harmful behavior consists of, or the levels of fairness and equanimity that must be followed by the MFIs. In tandem with other laws, this places onerous burdens on MFIs in terms of proving that fair and respectable treatment was afforded to their MFI clients by virtue of Section 111 of the Myanmar Evidence Act. Further details of Section 111 will follow later in this article. If a fiduciary relationship between MFIs and their clients is demanded for, a mere allegation by one of them could cause substantial

problems for the MFIs in defending themselves against wrongful or spurious allegations. The Notifications fail to adequately outline the degree of care and protection that must be instituted.

This requirement of fair and respectable treatment must also bear in mind any insolvency proceedings regarding MFI clients. While this requirement is generally enshrined under the Myanmar Consumer Protection Law 2014, a separate guideline for MFIs merely adds to the multiplicity and uncertainty over which rules apply.

e. Privacy of clients’ data: While the Notifications stipulate that MFIs must not over-indebt clients, taking into account their creditworthiness and repayment capabilities, there is no official data system in Myanmar to verify such information. Furthermore, due to the privacy requirements that MFIs must adhere to, they are barred from sharing client data amongst themselves. Therefore, the only option available to MFIs is to reply to statements from the clients or other local people in the vicinity (who may lack accurate information). This must be viewed together with MFI compliance requirements and the burden of proof that MFIs must bear with respect to the Evidence Act.

2) Similarly, Notification 3/2016 mandates that MFI loans can only be granted based on a client’s actual repayment capacity. As previously noted, this becomes a tedious obligation on the part of MFIs, prone as they are to defaulting on their compliance requirements due to the lack of official data and prohibitions on data sharing with other MFIs.

Consumer Protection Law, 2014Consumers purchase goods and services based on the contents and quality of products or services portrayed in advertisements. Legal protections for consumers are essential to safeguard them from possible exploitation and deception by suppliers, and to ensure that vendors found in violation are subject to appropriate administrative sanctions or penalties.

Page 48: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

SPECIAL FEATURE

46 www.inhousecommunity.com

In pursuit of this, in 1985, the United Nations General Assembly adopted a resolution recommending member states to take preventative, protective and remedial measures to defend consumer rights.

This resolution required member states to create agencies to adjudicate consumer claims and to create a conducive environment for the protection of consumers. More specifically, the UN General Assembly resolution required the establishment of Consumer Councils to address consumer complaints and claims. In response to this requirement, Myanmar enacted the Consumer Protection Law of 2014. The law envisages the following consumer rights:1) The right to be heard: The consumer has

the right to be heard if he or she has any complaint or grievance regarding the good or service received. This implies that consumer complaints and grievances must receive due attention and consideration at an appropriate forum.

2) The right to safety: The consumers are entitled to protection of their health and safety from the goods and services they buy. They should not be supplied goods or services which are hazardous to their health and safety.

3) The right against exploitation: This covers the right to protection from unfair trade practices and unscrupulous exploitation of consumers by charging excessive prices by suppliers of goods or services.

4) The right to be informed: This implies that consumers should be given correct and full information about the quality of goods that they buy. They should be provided information about the ingredients of the product, freshness of the product, any side effects that may occur as a result of consumption of a commodity. This right particularly concerns pharmaceutical

manufacturers and suppliers.5) The right to choose: This implies that

consumers should be provided with a variety of products from which they can make a choice of their liking. The opportunity to choose from limited options restricts this right.

6) The right to get redress: This implies that consumer complaints and grievances about the products and services supplied must be addressed. That is, they should not only be heard but their complaints must be suitably redressed and adequately compensated for.

The Consumer Protection Law, 2014 is a code in itself, which elaborately outlines the levels of service quality, similar to those of MFI services that entrepreneurs must abide by. However, in light of these Notifications, the requirements now incumbent upon MFIs seem to have been taken to a degree higher than those demanded by the Consumer Protection Laws. By virtue of “fair and respectable treatment to clients”, it potentially renders the MFI-client interaction as that of a fiduciary relationship, shifting the burden of proof from the consumer to the provider. While the Consumer Protection Law was a holistic piece of legislation in keeping with the situation and the times, the MFI Notifications may have overreached by placing an onerous and excessive responsibility on MFIs by introducing fiduciary requirements.

Usurious Loan Act, 1918An old law, Usurious Loan Act, tries to safeguard borrowers against any unfair practices by the lenders. As per the law, when a court is of the opinion that a given transaction has excessive interest or the transaction is somehow unfair, the court can re-open such transactions. The court has the power to relieve the debtor or any excessive interest and set the parties on an equitable footing.

The law defines “excessive as anything which the court deems reasonable having regard to the risk incurred by the creditor”. In considering whether interest is excessive under this section, the Court must take into account any amounts charged or paid, whether in cash or in kind, for expenses, inquiries, fines, bonuses, premiums, renewals or any other charges. If compound interest is charged, the periods at which it is calculated and the total

While the Consumer Protection Law was a holistic piece of legislation in keeping with the situation and the times, the MFI Notifications may have overreached by placing an onerous and excessive responsibility on MFIs by introducing fiduciary requirements

Page 49: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

Myanmar – Microfinance institutions and their obligations

47 Volume 15 Issue 1, 2017

advantage which may reasonably have been expected from the transaction will also be considered.

Furthermore, on the question of risk, the Court will take into account the presence or absence of security and the value thereof, the financial condition of the debtor, and the result of any previous transactions of the debtor.

In considering whether a transaction was substantially unfair, the Court will take into account all circumstances materially affecting the relations of the parties at the time of the loan or tending to show that the transaction was unfair, including the necessities of the debtor at the time of the loan, so far as the same were known, or taken to have been known, to the creditor.

While, the Notifications to some extend address the concerns covered by the Usurious Loan Act, it places additional requirements on the lenders to prove that such a loan was not usurious and an MFI client may merely have to lodge an allegation and bide his or her time.

Evidence Act 1872Section 111 of the Evidence Act states:

“Where there is a question as to the good faith of a transaction between parties, one of whom stands to the other in a position of active confidence, the burden of proving the utility of transaction is on the party in the position of active confidence.”

In the situation where a party is alleging against a transaction, the law presumes everything against such a transaction and the onus is placed upon the person holding the position of confidence to show that the transaction is perfectly fair and reasonable. Also, that no advantage has been taken of his or her position and that no information has been withheld.

This should be considered in light of the requirements prescribed by the Notifications. They mandate a requirement of “fair and respectful treatment to clients”. On the face of it, this is a welcoming statement when read in isolation, but in terms of practical applicability on the ground in Myanmar, it becomes a weighty burden on MFIs. The Notifications also mandate that MFIs must prevent over-indebtedness of the clients. Yet, there is no mechanism in Myanmar to correctly

ascertain the situation of any customer. MFIs generally rely on client statements and information gathered from the relevant group or individuals in the locality. The Notifications also restrict the sharing of data between the MFIs, further hampering the adoption of correct, adequately informed positions. No official credit rating agency or government data base exists that can be relied upon before considering any microfinance loan. With no access to such records, MFIs must rely on unofficial and often unreliable information. In this situation, where any MFI has been wrongly informed about the previous debts taken by the customer or the defaults it may have performed with other MFIs, the burden under Section 111 of the Evidence Act would still fall on the MFI to ensure that the transaction is fair and equitable.

Would the law safeguard borrowers against any legal recourse, if a borrower were to simply allege that the loan-issuance was not fair and created over-indebtedness? What would the consequences be and would the courts relieve the customer of any repayment obligations?

Page 50: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

SPECIAL FEATURE

48 www.inhousecommunity.com

What role would this play in the course of insolvency proceeding involving the defaulting customer? If the MFI were unable to prove whether over-indebtedness was caused through no fault of the MFI, will the claims of the MFI be rejected? Myriad such questions remain unanswered.

However, it is at least settled that the scope Section 111 does not extend beyond the parties to the transaction. It does not apply where the complainant is not a bona fide of a transaction but to the real nature of the transaction.

To illustrate- Section 111 would not apply to over-indebtedness per se but only as to the question of whether the MFI knowingly over-indebted the customer in bad faith. Where the question a court must decide upon is entirely outside the sphere of good faith, and the transaction is impugned from another angle all together, just because the transaction took place between an MFI and its customer, does not imply that the method of impugning it should be different. Therefore Section 111 should still apply.

However, this largely depends upon how the Myanmar courts interpret the requirement under Section 111 and there is clear lack of judicial precedent where MFIs are concerned.

Contract Act 1872The parameters of undue influence provided under the Myanmar Contract Section 16 differ from those provided under Section 111 of the Evidence Act. Here, whenever the good faith of a transaction is in question between persons, one of whom stands in a position of active confidence, the burden of proving good faith is placed on the person holding that position. However, under Section 16 (3) of the Contract

Act, the burden of proof is placed on the person in a position of dominance. When the transaction appears unconscionable, it must first be proven that that the dominant position was used to the detriment of the other person.

However, there is a lack of clarity as to which standards the courts in Myanmar will apply. Will it apply the strict standard under the Evidence Act, ignoring the Contract Act, or apply the standards under the Contract Act. There is lack of precedent in this regard.

Insolvency LawsMyanmar does not have any bankruptcy law but has two insolvency laws: (i) the Yangon Insolvency Act, 1909 (applies to Yangon division only, the “Yangon Act”) and (ii) the Myanmar Insolvency Act, 1920 (applies to all of Myanmar, other than the Yangon region, the “Myanmar Act”). The Yangon Act and Myanmar Act are collectively called as the “Insolvency Laws”. Both Acts contain almost the same provisions with a difference in the arrangement of the sections.

Section 25 of the Myanmar Act states:“In the case of a petition presented by a creditor, where the Court is not satisfied with the proof of his right to present the petition or of the service on the debtor of notice of the order admitting the petition, or of the alleged act of insolvency, or is satisfied by the debtor that he is able to pay his debts, or that for any other sufficient cause no order ought to be made, the Court shall dismiss the petition.

The power granted under the Insolvency Laws, allow the courts to dismiss petitions lodged by creditors. This assumes that any sufficient grounds may be stretched to include that the principles of “fair and respectable treatment” was not followed and the credit extended was forced over-indebtedness by an MFI. In the event that the insolvency courts agree that the forced over-indebtedness did not follow fair and respectable treatment principles, this can be grounds for dismissing the petition lodged by such an MFI.

Another question is whether the insolvency courts would follow the Myanmar Contract Act. Must the transaction first be proven to be unconscionable, shifting the burden of fairness onto the MFIs? Alternatively, would the courts follow Section 111 of the Evidence Act, where

In the event that the insolvency courts agree that the forced over-indebtedness did not follow fair and respectable treatment principles, this can be grounds for dismissing the petition lodged by such an MFI

Page 51: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

Myanmar – Microfinance institutions and their obligations

49 Volume 15 Issue 1, 2017

[email protected]

www.dfdl.com/

Nishant Choudhary is a senior legal advisor based in the Yangon office of DFDL. He has more than 10 years of experience practising law. In addition to banking and finance, his areas of expertise include power generation, oil and gas, real estate, general corporate, telecommunications and competition law. He has worked extensively in a wide range of sectors in Myanmar on diverse transactions, including offshore project financing, the largest onshore syndicate financing of Myanmar foreign banks branches and the licensing of one of these branches. Nishant also has substantial experience in the Micro Finance Institution (MFI) sector, where he has assisted with the licensing and financial structuring of MFIs for loan provision purposes.

the obligation would rest upon the MFIs from the very beginning?

Worth bearing in mind is that dismissal of a petition is not tantamount to a rejection of a claim in Myanmar courts.

In light of Section 35 of the Myanmar Act, where all claims to debt (except for debts incapable of being fairly estimated or demands due to liquidated damages) will be admitted; how this will be harmonised with the Notifications remains another question.

In the case of a borrower, uncertainty persists as to the suitable forum in which to raise the breach of fair and respectable treatment or an act of forceful over-indebtedness. Will the borrower approach the consumer dispute settlement committee under the Consumer Protection Law or an insolvency court?

An insolvency court would usually only be approached in the event that the borrower declares itself insolvent. A consumer dispute settlement committee or the regular civil court may be petitioned however, to enforce his or her rights under the Notification without declaring insolvency.

a) Protection of Certain Transactions (Claw Back)Are there any safeguards for payments made by MFIs in the event that a borrower declares itself insolvent and a period of suspicion is triggered? Yes, the following conditions apply:

Section 55 of the Yangon Act and Section 53 of the Myanmar Act provides that any transaction made within two years prior to the adjudication of insolvency will be void. This means that even if a transaction took place within two years prior to insolvency, it will still be held valid if performed in good faith and for valuable consideration.

Section 57 of the Yangon Act and Section 55 of the Myanmar Act provide that noting contained in the Insolvency Laws will apply to any payments to any of its creditors; any

payments or delivery to the insolvent party or any transfer by the insolvent party for valuable consideration.

The safeguards depend solely on how the courts would view fair and respectable treatment and forced over-indebtedness. To a large degree it would depend on the level of evidence sought by the court: ie, which will be primarily followed, the Myanmar Contract Act or the Myanmar Evidence Act?

Page 52: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

Your ‘at a glance’ guide to some of the region’s top service providers.

Indicates an AsiAn-menA Counsel Firm of the Year. 2014 2015 2016

MR An AsiAn-menA Counsel Most Responsive Firm of the Year.

— Law Firms —ASIA

Practice Area key:INV Alt’ Investment Funds (inc. PE)

COM Antitrust / Competition AV AviationBF Banking & FinanceCM Capital Markets

CMA Corporate & M&A

E EmploymentENR Energy & Natural ResourcesENV EnvironmentIA International ArbitrationIP Intellectual PropertyIF Islamic Finance

INS InsuranceLS Life Sciences

LDR Litigation & Dispute ResolutionMS Maritime & ShippingPF Projects & Project Finance

(inc. Infrastructure)

RE Real Estate / ConstructionREG Regulatory / Compliance RES Restructuring & InsolvencyTX Taxation

TMT Telecoms, Media & Technology

MR An AsiAn-menA Counsel Honourable Mention Most Responsive Firm of the Year.

One of this firm’s five largest practice areas in this jurisdiction. Indicates a full service firm in this jurisdiction.

ASIAN-MENA COUNSEL DIRECT

50 www.inhousecommunity.com

CAMBODIA/LAOS/MYANMARCAMBODIA:Bun & AssociatesTel: (855) 23 999 567Email: [email protected] Contact: Bun YoudyWebsite: www.bun-associates.com

BF CMA INS RE TX

——————

SCL SP&P Company Limited (Cambodia)(SCL Law Group)Tel: (856) 21 222 732-3Email: [email protected]: Varavudh MeesaiyatiWebsite: www.siamcitylaw.com

BF CMA E IP TX

——————

LAOS: SCL Law Offices Limited (Lao PDR)(SCL Law Group)Tel: (856) 21 222 732-3Email: [email protected]: Nilobon TangprasitWebsite: www.siamcitylaw.com

BF CMA E PF RES

——————

MYANMAR:Myanmar Legal Services LimitedTel: 951-657792; 951-650740Email: [email protected]: Daw Khin Cho Kyi ([email protected]) Guillaume E. Stafford ([email protected]) Website: www.myanmarlegalservices.comCMA E ENR PF RE

Siam City Law (Myanmar) Company Limited(SCL Law Group)Tel: (951) 653348-49Email: [email protected] Contact: Vira KammeeWebsite: www.siamcitylaw.com

CM CMA E IP PF

CHINAAWA IP (Beijing) Co., Ltd.Tel: 86 10 8573 1125Email: [email protected]: Ai-Leen LimWebsite: www.awapatent.com

IP TMT

——————

East & Concord Partners Tel: (86) 10 6590 6639 Email: [email protected] Contact: Mr. Qi Zhou Website: www.east-concord.com

BF CM CMA IP LDR

——————

Llinks Law OfficesTel: 8621-31358666Email: [email protected]: www.llinkslaw.com

BF CM CMA INV LDR

HONG KONGAWA Asia LimitedTel: (852) 3959 8880Email: [email protected]: Ai-Leen LimWebsite: www.awapatent.com

IP TMT

INDIA Anand and Anand 2014 2015 2016

Tel: (91) 120-4059300Email: [email protected]: Pravin Anand (Managing Partner)Website: www.anandandanand.com

IP LDR

——————

Clasis LawTel: +91 11 4213 0000 / +91 22 4910 0000Email(s): [email protected] Contact(s): Vineet Aneja / Mustafa MotiwalaWebsite: www.clasislaw.comCMA E IP LDR REG

INDONESIAAli Budiardjo, Nugroho, Reksodiputro 2013 2014 2015 Tel: (62) 21 250 5125/5136Email: [email protected] [email protected]: Emir Nurmansyah Nafis Adwani Agus Ahadi Deradjat Email: [email protected] [email protected] [email protected]: www.abnrlaw.com

MR BF CM CMA ENR PF

——————

Assegaf Hamzah & Partners 2014 2015 2016

Jakarta Office:Tel: (62) 21 25557800Email: [email protected]: Fikri Assegaf ([email protected]) Bono Adji ([email protected]) Eri Hertiawan ([email protected]) Eko Basyuni ([email protected]) Surabaya Office: Tel: (62) 31 5116 4550Contact: Yogi Marsono ([email protected])Website: www.ahp.co.id

MR BF CM CMA LDR PF

Page 53: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

51 Volume 14 Issue 10, 2017

Lubis Ganie Surowidjojo 2014 2015 2016

Tel: (62) 21 831 5005, 831 5025Email: [email protected]: Timbul Thomas Lubis, Dr. M. Idwan (‘Kiki’) Ganie, Arief Tarunakarya Surowidjojo, Abdul Haris M Rum, Harjon Sinaga, Rofik Sungkar, Dini Retnoningsih, Mochamad Fajar Syamsualdi and Ahmad Jamal Assegaf.Website: http://www.lgsonline.com

MR BF CMA LDR PF RES

——————

Makarim & Taira S. 2014 2015 Tel: (62) 21 252 1272, 520 0001Email: [email protected]: Rahayu Ningsih HoedWebsite: www.makarim.com

BF CMA E LDR PF

——————

Mochtar Karuwin Komar 2010 2011 2015

Tel: (62) 21 5711130Email: [email protected] / [email protected]: Emir KusumaatmadjaWebsite: www.mkklaw.net

AV CMA ENR LDR PF

——————

SSEK Legal Consultants 2014 2015 2016

Tel: (62) 21 521 2038, 2953 2000 Email: [email protected] Contact: Rusmaini Lenggogeni (Managing Partner) Website: www.ssek.com Blog: Indonesian Insights (http://blog.ssek.com/) Twitter: @ssek_lawfirm

BF CMA ENR MS RE

MALAYSIAAzmi & AssociatesTel: (603) 2118 5000Email: [email protected] Contact: Dato’ Azmi Mohd Ali (Senior Partner)Website: www.azmilaw.com

BF CM CMA ENR PF

——————

Raja, Darryl & Loh 2014 2015 2016

Tel: (603) 2694 9999 Email: [email protected]: Dato’ M. RajasekaranWebsite: http://www.rajadarrylloh.com

MR CMA IP LDR RE TX

——————

Trowers & Hamlins LLP 2015 2016

Tel: (601) 2615 0186Email: [email protected]: Nick White, PartnerWebsite: www.trowers.com

BF CMA ENR IF PF

PHILIPPINESACCRALAW (Angara Abello Concepcion Regala and Cruz Law Offices) 2015 2016

Tel: (632) 830 8000Email: [email protected]: Emerico O. De Guzman Regina Padilla Geraldez Neptali B. SalvaneraWebsite: www.accralaw.com

MR CMA E IP LDR TX

——————

Morales Justiniano Peña & Lumagui Tel: (632) 834 2551; (632) 832 7198; (632) 833 8534Email: [email protected]: Mr. Rafael Morales - Managing PartnerWebsite: www.primuslex.com

BF CM CMA IP LDR

——————

SyCip Salazar Hernandez & Gatmaitan 2011 2015 2016

Tel: (632) 9823500; 9823600; 9823700Email: [email protected]: Hector M. de Leon, Jr. - Managing Partner Website: www.syciplaw.com

MR BF CMA E ENR PF

——————

Villaraza & AngangcoTel: (632) 9886088Email: [email protected]: Franchette M. AcostaWebsite: www.thefirmva.comCMA IP LDR REG RES

SINGAPOREAdvocatus Law LLPTel: (65) 6603 9200Email: [email protected]: Christopher Anand Daniel, Managing Part-nerEmail: [email protected] Website: www.advocatus.sg CMA E IA LDR RES

——————

Eversheds Harry Elias LLPTel: (65) 6535 0550Email: [email protected]: Philip Fong, Managing Partner, Email: [email protected] Website: www.eversheds-harryelias.comCMA IA LDR RE RES

——————

Providence Law Asia LLCTel: (65) 6438 1969Email: [email protected]: Abraham Vergis, Managing Director Website: www.providencelawasia.com/CMA IA LDR RE RES

SOUTH KOREABae, Kim & Lee LLC

2014 2015 2016

Tel: (82 2) 3404 0000Email: [email protected]: Kyong Sun JungWebsite: www.bkl.co.kr

MR CM CMA IA LDR RE ——————

Cho & Partners 2012 Tel: (82-2) 6207-6800Email: [email protected]: Tae-Yeon Cho, Ik Hyun SeoWebsite: www.cholaw.com

IP LDR

——————

Jipyong 2012 2016

Tel: (82-2) 6200 1600Email: [email protected] Contact: Haeng-Gyu Lee (Partner) Website: www.jipyong.com

COM BF CMA RE LDR

——————

Kim & Chang 2014 2015 2016

Tel: (82-2) 3703-1114Email: [email protected]: www.kimchang.com

MR BF COM CMA IP LDR

——————

Lee International IP & Law Group 2012 2014 2015

Tel: (82 2) 2262 6000Email: [email protected]: www.leeinternational.comCMA IA IP LDR RE

——————

Shin & Kim 2014 2015 2016

Tel: (82 2) 316 4114Email: [email protected]: Sinseob Kang – Managing PartnerWebsite: www.shinkim.com

COM BF CMA LDR RE

——————

Yoon & Yang LLC 2014 2015 2016

Tel: (82 2) 6003 7000Email: [email protected]: Seung Soon Lim; Seung Soon Choi; Jinsu JeongWebsite: www.yoonyang.com

MR COM E IP LDR TX

——————

Yulchon LLC 2014 2015 2016

Tel: (82 2) 528 5200Email: [email protected]: www.yulchon.com

MR COM CMA IP LDR TX

Page 54: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

— Law Firms —AFRICA

ASIAN-MENA COUNSEL DIRECT

52 www.inhousecommunity.com

TAIWANDeep & Far Attorneys-at-LawTel: (8862) 25856688Email: [email protected]: Mr. C. F. TsaiWebsite: www.deepnfar.com.twCOM CM E IP LDR

THAILANDChandler MHM Limited

2014 2015 2016

Tel: (66) 2266 6485Email: [email protected] [email protected]: Jessada Sawatdipong Satoshi KawaiWebsite: www.chandlermhm.com

MR BF CMA ENR PF REG

——————

Siam City Law Offices Limited(SCL Law Group) 2016

Tel: (66) 2 676 6667-8 Email: [email protected]: Chavalit UttasartWebsite: www.siamcitylaw.com

BF CMA E RE TX

——————

Weerawong, Chinnavat & Partners Ltd.Tel: (66) 2 264 8000Email: [email protected] [email protected] Contacts: Chinnavat Chinsangaram (Senior Partner) Veeranuch Thammavaranucupt (Senior Partner) Website: www.weerawongcp.com

BF CM CMA LDR RES

VIETNAMIndochine Counsel 2015 Ho Chi Minh Office:Tel: (848) 3823 9640Email: [email protected]: Mr Dang The DucWebsite: www.indochinecounsel.com Hanoi Office:Tel: (844) 3795 5261Email: [email protected] CM PF

Horizons & Co Tel: (971) 4 354 4444Email: [email protected]: Adv. Ali Al Zarooni Website: www.horizlaw.ae CMA E LDR PF RE

—————

Trowers & Hamlins LLP 2015 2016

Dubai office:Tel: (971) 4 351 9201Email: [email protected]: Jehan Selim, Office ManagerAbu Dhabi office:Tel: (971) 2 410 7600Email: [email protected]: Jehan Selim, Office Manager Website: www.trowers.com

MR BF CMA LDR PF RES

CANADAFasken MartineauTel: (416) 366-8381Email: [email protected]: Mark Stinson, Primary ContactWebsite: www.fasken.com

BF CMA ENR LDR TMT

JOHANNESBURGFasken MartineauTel: (27) 11 586 6000Email: [email protected]: Blaize Vance, Regional Managing PartnerWebsite: www.fasken.comCMA E ENR LDR PF

Russin & Vecchi 2015 2016

HCM City:Tel: (84-28) 3824-3026Email: [email protected]: Sesto E Vecchi – Managing Partner Nguyen Huu Minh Nhut – Partner Nguyen Huu Hoai – Partner Hanoi: Tel: (84-24) 3825-1700Email: [email protected]: Mai Minh Hang - PartnerWebsite: www.russinvecchi.com.vn

MR CMA E IP INS TMT

——————

VILAFTel: (84) 28 3827 7300; (84) 24 39348530Email: [email protected]; [email protected]; [email protected] Contacts: Vo Ha Duyen; Nguyen Truc Hien; Dang Duong AnhWebsite: www.vilaf.com

BF CM ENR LDR RE

BAHRAINTrowers & HamlinsTel: (973) 1 751 5600Email: [email protected]: Louise Edwards, Office ManagerWebsite: www.trowers.com

BF CMA IF LDR RE

—————

OMANTrowers & HamlinsTel: (968) 2 468 2900Email: [email protected]: Louise Edwards, Office ManagerWebsite: www.trowers.com

BF CMA LDR PF RE

—————

UAEAfridi & Angell 2016

Tel: (971) 4 330 3900 Email: [email protected] Contact: Bashir Ahmed, Managing Partner Website: www.afridi-angell.com

BF CMA LDR RE REG

— Law Firms —MIDDLE EAST

— Law Firms —NORTH AMERICA

Looking for something else? We’re happy to help if we can!

Email our Head of Research, Yvette Tan at [email protected] with ‘Asian-mena Counsel Enquiry” in the subject line. ?

Page 55: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY

— Recruitment —

Risk, Investigation – and Litigation –

Support

— Other Services —

— Translation —

Charitable—Organisations

Arbitration — Services

Be Here Now!and online at

www.inhousecommunity.com

Email Rahul Prakash

[email protected]

with ‘AsiAn-menA Counsel Direct’ in the subject line for more

information.

53 Volume 14 Issue 10, 2017

ALS InternationalTel: Hong Kong – (852) 2920 9100 Singapore – (65) 6557 4163 Beijing – (86) 10 6567 8729 Shanghai – (86) 10 6372 1098 Email: [email protected]: alsrecruit.com

——————Hughes-Castell Tel: Hong Kong (852) 2520 1168Tel: Singapore (65) 6220 2722Tel: Beijing (86) 10 6581 1781Tel: Shanghai (86) 21 2206 1200Email: [email protected]: www.hughes-castell.com

——————JLegalTel: (65) 6818 9701Email: [email protected]: www.jlegal.com

——————Legal Labs RecruitmentTel: Singapore (65) 6236 0166Tel: Hong Kong (852) 2526 2981Email: [email protected]: www.legallabs.com

——————Lewis SandersTel: (852) 2537 7410Email: [email protected]: www.lewissanders.com

——————Pure Search InternationalTel: Hong Kong (852) 2499 1611Email: Hong Kong [email protected]: Singapore (65) 6407 1200Email: Singapore [email protected]: www.puresearch.com

——————Taylor RootTel: Singapore (65) 6420 0500Tel: Hong Kong (852) 2973 6333Email: [email protected]: www.taylorroot.com

IMF BenthamTel: (65) 6622 5397/ (65) 6622 5396Contact: Tom Glasgow, Investment Manager (Asia)Email: [email protected]: www.imf.sg

——————

KrollTel: (852) 2884 7788Contacts: Tad Kageyama: [email protected] Colum Bancroft: [email protected]: www.krolladvisory.com

Beijing Arbitration Commission / Beijing International Arbitration Center (Concurrently use)Tel: (86) 10 65669856Email: [email protected]: Mr. Jie Xu (許捷)Website: www.bjac.org.cn

——————

Hong Kong International Arbitration CentreTel: (852) 2525 2381Email: [email protected]: www.hkiac.org

Pacific Legal Translations LimitedSpecialist translators serving the legal community.Tel: (852) 2705-9456Email: [email protected]: www.paclegal.com

Impact India FoundationAn international initiative against avoidable disablement.Promoted by the UNDP, UNICEF and the World Health Organization in association with the Government of India.Tel: (91) 22 6633 9605 -7Email: [email protected]: www.impactindia.org

APPARELZen Tailor Shop No.B,2/F., Entertainment Building,30 Queen’s Road Central. Hong KongTel: (852) 2868 2948* Show your copy of AsiAn-menA Counsel (or this page)

to receive a 10% discount at Zen Tailor!

••••••••••••

MEDITATION Kadampa Meditation Centre Hong Kong KMC HK is a registered non-profit organisation. We offer systematic meditation and study programmes through drop-in classes, day courses, lunchtime meditations, weekend retreats and other classes. Tel: (852) 2507 2237 Email: [email protected] Website: http://www.meditation.hk

••••••••••••

MANDARINHong Kong Mandarin SchoolHong Kong Mandarin School– for business Putoghua.Tel: (852) 2287 5072Fax: (852) 2287 5237Email: [email protected]: www.mandarinlearning.hk

••••••••••••

SPORT & LEISURESplash Diving (HK) LimitedLearn to Dive and Fun Dive with the Winner of the PADI Outstanding Dive Centre/Resort Business Award!Tel: (852) 9047 9603 / (852) 2792 4495Email: [email protected]: http://www.splashhk.com/

Page 56: Volume 15 Issue 1, 2017 Cyber Security & Data Protection · Volume 15 Issue 1, 2017 CYBER SECURITY & DATA PROTECTION www. inhouse community.com | MAGAZINE FOR THEIN-HOUSE COMMUNITY